From e980e7a3abd9eb3800fced85ee136c7a8ec8ce21 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 27 Jan 2020 15:38:32 +0100
Subject: [PATCH 01/32] knot-resolver: enable checks on aarch64

The cqueues fix is in nixpkgs already, so it works now.
---
 pkgs/servers/dns/knot-resolver/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 953d8ebcbae..150d2b7a9f1 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -60,8 +60,7 @@ unwrapped = stdenv.mkDerivation rec {
     rm "$out"/lib/libkres.a
   '';
 
-  # aarch64: see https://github.com/wahern/cqueues/issues/223
-  doInstallCheck = with stdenv; hostPlatform == buildPlatform && !hostPlatform.isAarch64;
+  doInstallCheck = with stdenv; hostPlatform == buildPlatform;
   installCheckInputs = [ cmocka which cacert ];
   installCheckPhase = ''
     meson test --print-errorlogs

From 93ad21dedd01ff8bfc0f11ef069acc433069bbab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 27 Jan 2020 15:14:42 +0100
Subject: [PATCH 02/32] knot-resolver: remove older lua path workarounds

Part of this is approximate revert of commit f0d2da43a7a449b5888.
---
 pkgs/servers/dns/knot-resolver/default.nix | 34 ++++++----------------
 1 file changed, 9 insertions(+), 25 deletions(-)

diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 150d2b7a9f1..2dfb178b7ba 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -11,16 +11,9 @@ let # un-indented, over the whole file
 
 result = if extraFeatures then wrapped-full else unwrapped;
 
-inherit (stdenv.lib) optional optionals concatStringsSep;
+inherit (stdenv.lib) optional optionals;
 lua = luajitPackages;
 
-# FIXME: remove these usages once resolving
-# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
-exportLuaPathsFor = luaPkgs: ''
-  export LUA_PATH='${ concatStringsSep ";" (map lua.getLuaPath  luaPkgs)}'
-  export LUA_CPATH='${concatStringsSep ";" (map lua.getLuaCPath luaPkgs)}'
-'';
-
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
   version = "4.3.0";
@@ -34,8 +27,7 @@ unwrapped = stdenv.mkDerivation rec {
 
   preConfigure = ''
     patchShebangs scripts/
-  ''
-    + stdenv.lib.optionalString doInstallCheck (exportLuaPathsFor [ lua.cqueues lua.basexx ]);
+  '';
 
   nativeBuildInputs = [ pkgconfig meson ninja ];
 
@@ -61,7 +53,7 @@ unwrapped = stdenv.mkDerivation rec {
   '';
 
   doInstallCheck = with stdenv; hostPlatform == buildPlatform;
-  installCheckInputs = [ cmocka which cacert ];
+  installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx ];
   installCheckPhase = ''
     meson test --print-errorlogs
   '';
@@ -75,26 +67,18 @@ unwrapped = stdenv.mkDerivation rec {
   };
 };
 
-# FIXME: revert this back after resolving
-# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
-wrapped-full =
-  with stdenv.lib;
-  with luajitPackages;
-  let
-    luaPkgs = [
+wrapped-full = runCommand unwrapped.name
+  {
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = with luajitPackages; [
       luasec luasocket # trust anchor bootstrap, prefill module
       luafilesystem # prefill module
       http # for http module; brings lots of deps; some are useful elsewhere
-      cqueues fifo lpeg lpeg_patterns luaossl compat53 basexx binaryheap
     ];
-  in runCommand unwrapped.name
-  {
-    nativeBuildInputs = [ makeWrapper ];
     preferLocalBuild = true;
     allowSubstitutes = false;
   }
-  (exportLuaPathsFor luaPkgs
-  + ''
+  ''
     mkdir -p "$out"/{bin,share}
     makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
       --set LUA_PATH  "$LUA_PATH" \
@@ -106,6 +90,6 @@ wrapped-full =
     echo "Checking that 'http' module loads, i.e. lua search paths work:"
     echo "modules.load('http')" > test-http.lua
     echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-  '');
+  '';
 
 in result

From 0a8fb01b80397f1a4349d8b03dcda73a536b7b9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 27 Jan 2020 20:50:38 +0100
Subject: [PATCH 03/32] nixos/kresd: fix a recent error in description

---
 nixos/modules/services/networking/kresd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index bb941e93e15..3551e30c2e6 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -75,7 +75,7 @@ in {
       default = [];
       example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
       description = ''
-        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 7858).
+        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 8484).
         For detailed syntax see ListenStream in man systemd.socket.
       '';
     };

From ae74a0e27cab1034266bc868e889fcdffd23a188 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 26 Jan 2020 21:15:20 +0100
Subject: [PATCH 04/32] (nixos/)knot-resolver: 4.3.0 -> 5.0.0

Minor incompatibilities due to moving to upstream defaults:
  - capabilities are used instead of systemd.socket units
  - the control socket moved:
    /run/kresd/control -> /run/knot-resolver/control/1
  - cacheDir moved and isn't configurable anymore
  - different user+group names, without static IDs

Thanks Mic92 for multiple ideas.
---
 nixos/modules/misc/ids.nix                  |   4 +-
 nixos/modules/services/networking/kresd.nix | 138 ++++++++------------
 pkgs/servers/dns/knot-resolver/default.nix  |  43 ++++--
 3 files changed, 91 insertions(+), 94 deletions(-)

diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index bedd87a368e..979cdc5d4ad 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -299,7 +299,7 @@ in
       couchpotato = 267;
       gogs = 268;
       pdns-recursor = 269;
-      kresd = 270;
+      #kresd = 270; # switched to "knot-resolver" with dynamic ID
       rpc = 271;
       geoip = 272;
       fcron = 273;
@@ -600,7 +600,7 @@ in
       headphones = 266;
       couchpotato = 267;
       gogs = 268;
-      kresd = 270;
+      #kresd = 270; # switched to "knot-resolver" with dynamic ID
       #rpc = 271; # unused
       #geoip = 272; # unused
       fcron = 273;
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index 3551e30c2e6..ce16b90b9cc 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -3,12 +3,34 @@
 with lib;
 
 let
-
   cfg = config.services.kresd;
-  configFile = pkgs.writeText "kresd.conf" ''
-    ${optionalString (cfg.listenDoH != []) "modules.load('http')"}
-    ${cfg.extraConfig};
-  '';
+
+  # Convert systemd-style address specification to kresd config line(s).
+  # On Nix level we don't attempt to precisely validate the address specifications.
+  mkListen = kind: addr: let
+    al_v4 = builtins.match "([0-9.]\+):([0-9]\+)" addr;
+    al_v6 = builtins.match "\\[(.\+)]:([0-9]\+)" addr;
+    al_portOnly = builtins.match "()([0-9]\+)" addr;
+    al = findFirst (a: a != null)
+      (throw "services.kresd.*: incorrect address specification '${addr}'")
+      [ al_v4 al_v6 al_portOnly ];
+    port = last al;
+    addrSpec = if al_portOnly == null then "'${head al}'" else "{'::', '127.0.0.1'}";
+    in # freebind is set for compatibility with earlier kresd services;
+       # it could be configurable, for example.
+      ''
+        net.listen(${addrSpec}, ${port}, { kind = '${kind}', freebind = true })
+      '';
+
+  configFile = pkgs.writeText "kresd.conf" (
+    optionalString (cfg.listenDoH != []) ''
+      modules.load('http')
+    ''
+    + concatMapStrings (mkListen "dns") cfg.listenPlain
+    + concatMapStrings (mkListen "tls") cfg.listenTLS
+    + concatMapStrings (mkListen "doh") cfg.listenDoH
+    + cfg.extraConfig
+  );
 
   package = pkgs.knot-resolver.override {
     extraFeatures = cfg.listenDoH != [];
@@ -25,6 +47,7 @@ in {
           value
       )
     )
+    (mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
   ];
 
   ###### interface
@@ -35,8 +58,8 @@ in {
       description = ''
         Whether to enable knot-resolver domain name server.
         DNSSEC validation is turned on by default.
-        You can run <literal>sudo nc -U /run/kresd/control</literal>
-        and give commands interactively to kresd.
+        You can run <literal>sudo nc -U /run/knot-resolver/control/1</literal>
+        and give commands interactively to kresd@1.service.
       '';
     };
     extraConfig = mkOption {
@@ -46,16 +69,10 @@ in {
         Extra lines to be added verbatim to the generated configuration file.
       '';
     };
-    cacheDir = mkOption {
-      type = types.path;
-      default = "/var/cache/kresd";
-      description = ''
-        Directory for caches.  They are intended to survive reboots.
-      '';
-    };
     listenPlain = mkOption {
       type = with types; listOf str;
       default = [ "[::1]:53" "127.0.0.1:53" ];
+      example = [ "53" ];
       description = ''
         What addresses and ports the server should listen on.
         For detailed syntax see ListenStream in man systemd.socket.
@@ -84,82 +101,35 @@ in {
 
   ###### implementation
   config = mkIf cfg.enable {
-    environment.etc."kresd.conf".source = configFile; # not required
+    environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
 
-    users.users.kresd =
-      { uid = config.ids.uids.kresd;
-        group = "kresd";
+    users.users.knot-resolver =
+      { isSystemUser = true;
+        group = "knot-resolver";
         description = "Knot-resolver daemon user";
       };
-    users.groups.kresd.gid = config.ids.gids.kresd;
+    users.groups.knot-resolver.gid = null;
 
-    systemd.sockets.kresd = rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      listenStreams = cfg.listenPlain;
-      socketConfig = {
-        ListenDatagram = listenStreams;
-        FreeBind = true;
-        FileDescriptorName = "dns";
-      };
+    systemd.packages = [ package ]; # the units are patched inside the package a bit
+
+    systemd.targets.kresd = {
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "kres-cache-gc.service" "kresd@1.service" ];
+    };
+    systemd.services."kresd@".serviceConfig = {
+      ExecStart = "${package}/bin/kresd --noninteractive "
+        + "-c ${package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
+      # Ensure correct ownership in case UID or GID changes.
+      CacheDirectory = "knot-resolver";
+      CacheDirectoryMode = "0750";
     };
 
-    systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      partOf = [ "kresd.socket" ];
-      listenStreams = cfg.listenTLS;
-      socketConfig = {
-        FileDescriptorName = "tls";
-        FreeBind = true;
-        Service = "kresd.service";
-      };
-    };
+    environment.etc."tmpfiles.d/knot-resolver.conf".source =
+      "${package}/lib/tmpfiles.d/knot-resolver.conf";
 
-    systemd.sockets.kresd-doh = mkIf (cfg.listenDoH != []) rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      partOf = [ "kresd.socket" ];
-      listenStreams = cfg.listenDoH;
-      socketConfig = {
-        FileDescriptorName = "doh";
-        FreeBind = true;
-        Service = "kresd.service";
-      };
-    };
-
-    systemd.sockets.kresd-control = rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      partOf = [ "kresd.socket" ];
-      listenStreams = [ "/run/kresd/control" ];
-      socketConfig = {
-        FileDescriptorName = "control";
-        Service = "kresd.service";
-        SocketMode = "0660"; # only root user/group may connect and control kresd
-      };
-    };
-
-    systemd.tmpfiles.rules = [ "d '${cfg.cacheDir}' 0770 kresd kresd - -" ];
-
-    systemd.services.kresd = {
-      description = "Knot-resolver daemon";
-
-      serviceConfig = {
-        User = "kresd";
-        Type = "notify";
-        WorkingDirectory = cfg.cacheDir;
-        Restart = "on-failure";
-        Sockets = [ "kresd.socket" "kresd-control.socket" ]
-          ++ optional (cfg.listenTLS != []) "kresd-tls.socket";
-      };
-
-      # Trust anchor goes from dns-root-data by default.
-      script = ''
-        exec '${package}/bin/kresd' --config '${configFile}' --forks=1
-      '';
-
-      requires = [ "kresd.socket" ];
-    };
+    # Try cleaning up the previously default location of cache file.
+    # Note that /var/cache/* should always be safe to remove.
+    # TODO: remove later, probably between 20.09 and 21.03
+    systemd.tmpfiles.rules = [ "R /var/cache/kresd" ];
   };
 }
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 2dfb178b7ba..29088e60153 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 # native deps.
 , runCommand, pkgconfig, meson, ninja, makeWrapper
 # build+runtime deps.
@@ -16,15 +16,38 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "4.3.0";
+  version = "5.0.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "0ca0f171ae2b2d76830967a5150eb0fa496b48b2a48f41b2be65d3743aaece25";
+    sha256 = "ca6023cd0c18b11f4a0cff0c8e882c7f3a5ad6653e9aa95acdbedafc5a53a5ed";
   };
 
   outputs = [ "out" "dev" ];
 
+  patches = [
+    (fetchpatch { # TODO: included in the next release.
+      name = "fix-GC-path.patch";
+      url = "https://gitlab.labs.nic.cz/knot/knot-resolver/commit/b723dbbe0.diff";
+      sha256 = "1hrwbv9vjybnwm083jxcinzw3fmwlsf1dgxrly7mhjs8d3jhqc4z";
+    })
+  ];
+
+  # Path fixups for the NixOS service.
+  postPatch = ''
+    patch meson.build <<EOF
+    @@ -50,2 +50,2 @@
+    -systemd_work_dir = join_paths(prefix, get_option('localstatedir'), 'lib', 'knot-resolver')
+    -systemd_cache_dir = join_paths(prefix, get_option('localstatedir'), 'cache', 'knot-resolver')
+    +systemd_work_dir  = '/var/lib/knot-resolver'
+    +systemd_cache_dir = '/var/cache/knot-resolver'
+    EOF
+
+    # ExecStart can't be overwritten in overrides.
+    # We need that to use wrapped executable and correct config file.
+    sed '/^ExecStart=/d' -i systemd/kresd@.service.in
+  '';
+
   preConfigure = ''
     patchShebangs scripts/
   '';
@@ -45,11 +68,13 @@ unwrapped = stdenv.mkDerivation rec {
   ]
   ++ optional doInstallCheck "-Dunit_tests=enabled"
   ++ optional (doInstallCheck && !stdenv.isDarwin) "-Dconfig_tests=enabled"
+  ++ optional stdenv.isLinux "-Dsystemd_files=enabled" # used by NixOS service
     #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
   ;
 
   postInstall = ''
     rm "$out"/lib/libkres.a
+    rm "$out"/lib/knot-resolver/upgrade-4-to-5.lua # not meaningful on NixOS
   '';
 
   doInstallCheck = with stdenv; hostPlatform == buildPlatform;
@@ -71,20 +96,22 @@ wrapped-full = runCommand unwrapped.name
   {
     nativeBuildInputs = [ makeWrapper ];
     buildInputs = with luajitPackages; [
-      luasec luasocket # trust anchor bootstrap, prefill module
-      luafilesystem # prefill module
-      http # for http module; brings lots of deps; some are useful elsewhere
+      # For http module, prefill module, trust anchor bootstrap.
+      # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
+      http
+      # psl isn't in nixpkgs yet, but policy.slice_randomize_psl() seems not important.
     ];
     preferLocalBuild = true;
     allowSubstitutes = false;
   }
   ''
-    mkdir -p "$out"/{bin,share}
+    mkdir -p "$out"/bin
     makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
       --set LUA_PATH  "$LUA_PATH" \
       --set LUA_CPATH "$LUA_CPATH"
 
-    ln -sr '${unwrapped}/share/man' "$out"/share/
+    ln -sr '${unwrapped}/share' "$out"/
+    ln -sr '${unwrapped}/lib'   "$out"/ # useful in NixOS service
     ln -sr "$out"/{bin,sbin}
 
     echo "Checking that 'http' module loads, i.e. lua search paths work:"

From 02bf0557c0a91ff706cf15272db4a22344cbfb16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 27 Jan 2020 19:23:49 +0100
Subject: [PATCH 05/32] nixos/kresd: add .instances option

---
 nixos/modules/services/networking/kresd.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index ce16b90b9cc..a2f91a4200b 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -96,6 +96,15 @@ in {
         For detailed syntax see ListenStream in man systemd.socket.
       '';
     };
+    instances = mkOption {
+      type = types.ints.unsigned;
+      default = 1;
+      description = ''
+        The number of instances to start.  They will be called kresd@{1,2,...}.service.
+        Knot Resolver uses no threads, so this is the way to scale.
+        You can dynamically start/stop them at will, so this is just system default.
+      '';
+    };
     # TODO: perhaps options for more common stuff like cache size or forwarding
   };
 
@@ -112,9 +121,10 @@ in {
 
     systemd.packages = [ package ]; # the units are patched inside the package a bit
 
-    systemd.targets.kresd = {
+    systemd.targets.kresd = { # configure units started by default
       wantedBy = [ "multi-user.target" ];
-      wants = [ "kres-cache-gc.service" "kresd@1.service" ];
+      wants = [ "kres-cache-gc.service" ]
+        ++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
     };
     systemd.services."kresd@".serviceConfig = {
       ExecStart = "${package}/bin/kresd --noninteractive "

From b020b0153de696064d436f93b81a04a0531ea02b Mon Sep 17 00:00:00 2001
From: wucke13 <wucke13@gmail.com>
Date: Mon, 3 Feb 2020 18:38:03 +0100
Subject: [PATCH 06/32] paraview: add wrapQtAppsHook

Also reformatted meta and arguments
---
 .../graphics/paraview/default.nix             | 24 ++++++++-----------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index d0351e98ee0..ac01c28ebd4 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -1,9 +1,5 @@
-{
-stdenv, fetchFromGitHub, cmake, makeWrapper
-,qtbase, qttools, python, libGLU, libGL
-,libXt, qtx11extras, qtxmlpatterns
-, mkDerivation
-}:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, qtbase , qttools, python
+, libGLU, libGL , libXt, qtx11extras, qtxmlpatterns , mkDerivation }:
 
 mkDerivation rec {
   pname = "paraview";
@@ -53,20 +49,20 @@ mkDerivation rec {
 
   # Paraview links into the Python library, resolving symbolic links on the way,
   # so we need to put the correct sitePackages (with numpy) back on the path
-  postInstall = ''
-    wrapProgram $out/bin/paraview \
+  preFixup = ''
+    wrapQtApp $out/bin/paraview \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapProgram $out/bin/pvbatch \
+    wrapQtApp $out/bin/pvbatch \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapProgram $out/bin/pvpython \
+    wrapQtApp $out/bin/pvpython \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.paraview.org/;
     description = "3D Data analysis and visualization application";
-    license = stdenv.lib.licenses.free;
-    maintainers = with stdenv.lib.maintainers; [guibert];
-    platforms = with stdenv.lib.platforms; linux;
+    license = licenses.free;
+    maintainers = with maintainers; [ guibert ];
+    platforms = platforms.linux;
   };
 }

From 5485b44d94b9fafbf686c70bace4fd6735ebce4c Mon Sep 17 00:00:00 2001
From: Marek Mahut <marek.mahut@gmail.com>
Date: Tue, 4 Feb 2020 15:22:06 +0100
Subject: [PATCH 07/32] sequoia: 0.11.0 -> 0.13.0

---
 pkgs/tools/security/sequoia/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 21403225aad..75fc66647e8 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -9,16 +9,16 @@ assert pythonSupport -> pythonPackages != null;
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia";
-  version = "0.11.0";
+  version = "0.13.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1k0pr3vn77fpfzyvbg7xb4jwm6srsiws9bsd8q7i3hl6j56a880i";
+    sha256 = "0hxdjzd2qjwf9pbnkzrnzlg0xa8vf1f65aryq7pd9895bpnk7740";
   };
 
-  cargoSha256 = "15bhg7b88rq8p0bn6y5wwv2l42kqb1qyx2s3kw0r0v0wadf823q3";
+  cargoSha256 = "0w968ynxqkznp9g1ah040iv6ghwqwqjk1cjlr2f0j5fs57rspzf2";
 
   nativeBuildInputs = [
     pkgconfig

From 3c54ae567945422ac1bb00a09b16e9ea51449fb4 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 4 Feb 2020 16:40:50 +0000
Subject: [PATCH 08/32] SPAdes: 3.13.1 -> 3.14.0

---
 pkgs/applications/science/biology/spades/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/biology/spades/default.nix b/pkgs/applications/science/biology/spades/default.nix
index a195f79010a..08a6a0d2509 100644
--- a/pkgs/applications/science/biology/spades/default.nix
+++ b/pkgs/applications/science/biology/spades/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "SPAdes";
-  version = "3.13.1";
+  version = "3.14.0";
 
   src = fetchurl {
     url = "http://cab.spbu.ru/files/release${version}/${pname}-${version}.tar.gz";
-    sha256 = "0giayz197lmq2108filkn9izma3i803sb3iskv9hs5snzdr9p8ld";
+    sha256 = "1ffxswd2ngkpy1d6l3lb6a9cmyy1fglbdsws00b3m1k22zaqv60q";
   };
 
   nativeBuildInputs = [ cmake ];

From c484d6376c1a7a77003a2e1d2350b24a86106112 Mon Sep 17 00:00:00 2001
From: edef <edef@edef.eu>
Date: Thu, 30 Jan 2020 21:59:33 +0000
Subject: [PATCH 09/32] google-cloud-sdk: remove crcmod_osx as well

Both third_party/crcmod_osx and third_party/crcmod are only used in the
PYTHONPATH, and we already replace them with dependencies from nixpkgs.
---
 pkgs/tools/admin/google-cloud-sdk/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 5bcc25ea989..959c854d6e7 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -76,7 +76,8 @@ in stdenv.mkDerivation rec {
 
     # This directory contains compiled mac binaries. We used crcmod from
     # nixpkgs instead.
-    rm -r $out/google-cloud-sdk/platform/gsutil/third_party/crcmod
+    rm -r $out/google-cloud-sdk/platform/gsutil/third_party/crcmod \
+          $out/google-cloud-sdk/platform/gsutil/third_party/crcmod_osx
   '';
 
   meta = with stdenv.lib; {

From dbaafbbf73ef5aeb2fa7d5aea73bb32b9d78e4f3 Mon Sep 17 00:00:00 2001
From: edef <edef@edef.eu>
Date: Fri, 31 Jan 2020 08:43:23 +0000
Subject: [PATCH 10/32] google-cloud-sdk: remove tests directories

This reduces output size by 4.5 MiB.
---
 pkgs/tools/admin/google-cloud-sdk/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 959c854d6e7..fccd3d12acf 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -78,6 +78,9 @@ in stdenv.mkDerivation rec {
     # nixpkgs instead.
     rm -r $out/google-cloud-sdk/platform/gsutil/third_party/crcmod \
           $out/google-cloud-sdk/platform/gsutil/third_party/crcmod_osx
+
+    # remove tests and test data
+    find $out -name tests -type d -exec rm -rf '{}' +
   '';
 
   meta = with stdenv.lib; {

From b7641eaa5a689decfd3fc2c0e74d475eb20bbd64 Mon Sep 17 00:00:00 2001
From: edef <edef@edef.eu>
Date: Fri, 31 Jan 2020 08:53:02 +0000
Subject: [PATCH 11/32] google-cloud-sdk: compact all the JSON

This reduces output size by 20 MiB.
---
 pkgs/tools/admin/google-cloud-sdk/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index fccd3d12acf..1a19d92984e 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -7,7 +7,7 @@
 #   3) used by `google-cloud-sdk` only on GCE guests
 #
 
-{ stdenv, lib, fetchurl, makeWrapper, python, openssl, with-gce ? false }:
+{ stdenv, lib, fetchurl, makeWrapper, python, openssl, jq, with-gce ? false }:
 
 let
   pythonEnv = python.withPackages (p: with p; [
@@ -38,6 +38,8 @@ in stdenv.mkDerivation rec {
 
   buildInputs = [ python makeWrapper ];
 
+  nativeBuildInputs = [ jq ];
+
   patches = [
     ./gcloud-path.patch
   ];
@@ -81,6 +83,12 @@ in stdenv.mkDerivation rec {
 
     # remove tests and test data
     find $out -name tests -type d -exec rm -rf '{}' +
+
+    # compact all the JSON
+    find $out -name \*.json | while read path; do
+      jq -c . $path > $path.min
+      mv $path.min $path
+    done
   '';
 
   meta = with stdenv.lib; {

From 6ceebc441c43c0fd0ef5c61058c1c8ec3b93bc02 Mon Sep 17 00:00:00 2001
From: edef <edef@edef.eu>
Date: Fri, 31 Jan 2020 08:57:26 +0000
Subject: [PATCH 12/32] google-cloud-sdk: strip the Cython gRPC library

This reduces output size by 21 MiB.
---
 pkgs/tools/admin/google-cloud-sdk/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index 1a19d92984e..07a81a5c525 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -89,6 +89,9 @@ in stdenv.mkDerivation rec {
       jq -c . $path > $path.min
       mv $path.min $path
     done
+
+    # strip the Cython gRPC library
+    strip $out/google-cloud-sdk/lib/third_party/grpc/_cython/cygrpc.so
   '';
 
   meta = with stdenv.lib; {

From 0c20feb231eb9a98bcf8b7ee3f2876302437e8ca Mon Sep 17 00:00:00 2001
From: Richard Marko <srk@48.io>
Date: Sat, 17 Feb 2018 23:33:24 +0100
Subject: [PATCH 13/32] use overlayfs by default for netboot and iso

---
 nixos/modules/installer/cd-dvd/iso-image.nix | 14 +++++++++-----
 nixos/modules/installer/netboot/netboot.nix  | 14 +++++++++-----
 nixos/modules/system/boot/stage-1-init.sh    | 13 ++++++++-----
 3 files changed, 26 insertions(+), 15 deletions(-)

diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 11319e5f4f8..4558b4dc955 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -569,14 +569,18 @@ in
       };
 
     fileSystems."/nix/store" =
-      { fsType = "unionfs-fuse";
-        device = "unionfs";
-        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
+      { fsType = "overlay";
+        device = "overlay";
+        options = [
+          "lowerdir=/nix/.ro-store"
+          "upperdir=/nix/.rw-store/store"
+          "workdir=/nix/.rw-store/work"
+        ];
       };
 
-    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" ];
+    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" "overlay" ];
 
-    boot.initrd.kernelModules = [ "loop" ];
+    boot.initrd.kernelModules = [ "loop" "overlay" ];
 
     # Closures to be copied to the Nix store on the CD, namely the init
     # script and the top-level system configuration directory.
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index 5146858cccf..95eba86bcb6 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -50,14 +50,18 @@ with lib;
       };
 
     fileSystems."/nix/store" =
-      { fsType = "unionfs-fuse";
-        device = "unionfs";
-        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
+      { fsType = "overlay";
+        device = "overlay";
+        options = [
+          "lowerdir=/nix/.ro-store"
+          "upperdir=/nix/.rw-store/store"
+          "workdir=/nix/.rw-store/work"
+        ];
       };
 
-    boot.initrd.availableKernelModules = [ "squashfs" ];
+    boot.initrd.availableKernelModules = [ "squashfs" "overlay" ];
 
-    boot.initrd.kernelModules = [ "loop" ];
+    boot.initrd.kernelModules = [ "loop" "overlay" ];
 
     # Closures to be copied to the Nix store, namely the init
     # script and the top-level system configuration directory.
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index f520bf54ad1..8736613c3d2 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -334,8 +334,10 @@ mountFS() {
 
     # Filter out x- options, which busybox doesn't do yet.
     local optionsFiltered="$(IFS=,; for i in $options; do if [ "${i:0:2}" != "x-" ]; then echo -n $i,; fi; done)"
+    # Prefix (lower|upper|work)dir with /mnt-root (overlayfs)
+    local optionsPrefixed="$( echo "$optionsFiltered" | sed -E 's#\<(lowerdir|upperdir|workdir)=#\1=/mnt-root#g' )"
 
-    echo "$device /mnt-root$mountPoint $fsType $optionsFiltered" >> /etc/fstab
+    echo "$device /mnt-root$mountPoint $fsType $optionsPrefixed" >> /etc/fstab
 
     checkFS "$device" "$fsType"
 
@@ -354,10 +356,11 @@ mountFS() {
             ;;
     esac
 
-    # Create backing directories for unionfs-fuse.
-    if [ "$fsType" = unionfs-fuse ]; then
-        for i in $(IFS=:; echo ${options##*,dirs=}); do
-            mkdir -m 0700 -p /mnt-root"${i%=*}"
+    # Create backing directories for overlayfs
+    if [ "$fsType" = overlay ]; then
+        for i in upper work; do
+             dir="$( echo "$optionsPrefixed" | grep -o "${i}dir=[^,]*" )"
+             mkdir -m 0700 -p "${dir##*=}"
         done
     fi
 

From 2a8df18591d137c1d1dfcaec86f993f2b88d81e6 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
Date: Thu, 30 Jan 2020 15:49:48 -0500
Subject: [PATCH 14/32] imlib2: 1.5.1 -> 1.6.1

---
 pkgs/development/libraries/imlib2/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 2576580908a..9fb15ae01bc 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -5,11 +5,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "imlib2-1.5.1";
+  pname = "imlib2";
+  version = "1.6.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/enlightenment/${name}.tar.bz2";
-    sha256 = "1bms2iwmvnvpz5jqq3r52glarqkafif47zbh1ykz8hw85d2mfkps";
+    url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.bz2";
+    sha256 = "0v8n3dswx7rxqfd0q03xwc7j2w1mv8lv18rdxv487a1xw5vklfad";
   };
 
   buildInputs = [ libjpeg libtiff giflib libpng bzip2 freetype libid3tag ]

From b0f9922f3734dfaf52de13dacd3cfcb4bdd4ad0d Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
Date: Thu, 30 Jan 2020 15:50:21 -0500
Subject: [PATCH 15/32] imlib2: Fix license, remove global with

---
 pkgs/development/libraries/imlib2/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 9fb15ae01bc..ef535bbd86e 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -2,8 +2,9 @@
 , freetype, libid3tag
 , x11Support ? true, xlibsWrapper ? null }:
 
-with stdenv.lib;
-
+let
+  inherit (stdenv.lib) optional;
+in
 stdenv.mkDerivation rec {
   pname = "imlib2";
   version = "1.6.1";
@@ -36,7 +37,7 @@ stdenv.mkDerivation rec {
     moveToOutput bin/imlib2-config "$dev"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Image manipulation library";
 
     longDescription = ''
@@ -47,8 +48,8 @@ stdenv.mkDerivation rec {
       easily, without sacrificing speed.
     '';
 
-    homepage = http://docs.enlightenment.org/api/imlib2/html;
-    license = licenses.free;
+    homepage = "https://docs.enlightenment.org/api/imlib2/html";
+    license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ spwhitt ];
   };

From 968d075bd978db46b9119324af270ffdd41292d4 Mon Sep 17 00:00:00 2001
From: Samuel Dionne-Riel <samuel@dionne-riel.com>
Date: Thu, 30 Jan 2020 15:50:44 -0500
Subject: [PATCH 16/32] imlib2: Add webp support

And better document why id3 is there

In addition, review function signature formatting.
---
 pkgs/development/libraries/imlib2/default.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index ef535bbd86e..36b1063531e 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -1,6 +1,11 @@
-{ stdenv, fetchurl, libjpeg, libtiff, giflib, libpng, bzip2, pkgconfig
-, freetype, libid3tag
-, x11Support ? true, xlibsWrapper ? null }:
+{ stdenv, fetchurl
+# Image file formats
+, libjpeg, libtiff, giflib, libpng, libwebp
+# imlib2 can load images from ID3 tags.
+, libid3tag
+, freetype , bzip2, pkgconfig
+, x11Support ? true, xlibsWrapper ? null
+}:
 
 let
   inherit (stdenv.lib) optional;
@@ -14,8 +19,10 @@ stdenv.mkDerivation rec {
     sha256 = "0v8n3dswx7rxqfd0q03xwc7j2w1mv8lv18rdxv487a1xw5vklfad";
   };
 
-  buildInputs = [ libjpeg libtiff giflib libpng bzip2 freetype libid3tag ]
-    ++ optional x11Support xlibsWrapper;
+  buildInputs = [
+    libjpeg libtiff giflib libpng libwebp
+    bzip2 freetype libid3tag
+  ] ++ optional x11Support xlibsWrapper;
 
   nativeBuildInputs = [ pkgconfig ];
 

From 42a2668eb07b169264bca841a1ae31a11452b178 Mon Sep 17 00:00:00 2001
From: Leonhard Markert <curiousleo@users.noreply.github.com>
Date: Tue, 4 Feb 2020 17:13:36 +0100
Subject: [PATCH 17/32] lorri: unstable-2020-01-09 -> 1.0

---
 nixos/tests/lorri/default.nix     | 6 +++---
 pkgs/tools/misc/lorri/default.nix | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/nixos/tests/lorri/default.nix b/nixos/tests/lorri/default.nix
index 53074385a65..198171082d8 100644
--- a/nixos/tests/lorri/default.nix
+++ b/nixos/tests/lorri/default.nix
@@ -15,12 +15,12 @@ import ../make-test-python.nix {
 
     # Start the daemon and wait until it is ready
     machine.execute("lorri daemon > lorri.stdout 2> lorri.stderr &")
-    machine.wait_until_succeeds("grep --fixed-strings 'lorri: ready' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'ready' lorri.stdout")
 
     # Ping the daemon
-    machine.execute("lorri ping_ $(readlink -f shell.nix)")
+    machine.succeed("lorri internal__ping shell.nix")
 
     # Wait for the daemon to finish the build
-    machine.wait_until_succeeds("grep --fixed-strings 'OutputPaths' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'Completed' lorri.stdout")
   '';
 }
diff --git a/pkgs/tools/misc/lorri/default.nix b/pkgs/tools/misc/lorri/default.nix
index ea0bbe3dfe2..bbf71dec4d3 100644
--- a/pkgs/tools/misc/lorri/default.nix
+++ b/pkgs/tools/misc/lorri/default.nix
@@ -14,7 +14,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lorri";
-  version = "unstable-2020-01-09";
+  version = "1.0";
 
   meta = with stdenv.lib; {
     description = "Your project's nix-env";
@@ -27,11 +27,11 @@ rustPlatform.buildRustPackage rec {
     owner = "target";
     repo = pname;
     # Run `eval $(nix-build -A lorri.updater)` after updating the revision!
-    rev = "7b84837b9988d121dd72178e81afd440288106c5";
-    sha256 = "0rkga944jl6i0051vbsddfqbvzy12168cbg4ly2ng1rk0x97dbr8";
+    rev = "88c680c9abf0f04f2e294436d20073ccf26f0781";
+    sha256 = "1415mhdr0pwvshs04clfz1ys76r5qf9jz8jchm63l6llaj6m7mrv";
   };
 
-  cargoSha256 = "0k7l0zhk2vzf4nlwv4xr207irqib2dqjxfdjk1fprff84c4kblx8";
+  cargoSha256 = "1kdpzbn3353yk7i65hll480fcy16wdvppdr6xgfh06x88xhim4mp";
   doCheck = false;
 
   BUILD_REV_COUNT = src.revCount or 1;

From f58c90fa8d2a65211f2cfe15304438336776db82 Mon Sep 17 00:00:00 2001
From: tilpner <till@hoeppner.ws>
Date: Wed, 5 Feb 2020 13:39:07 +0100
Subject: [PATCH 18/32] sudo: 1.8.30 -> 1.8.31

---
 pkgs/tools/security/sudo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 71a71be9147..842509888b4 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.8.30";
+  version = "1.8.31";
 
   src = fetchurl {
     url = "ftp://ftp.sudo.ws/pub/sudo/${pname}-${version}.tar.gz";
-    sha256 = "1rvrqlqrrjsd06dczgj9cwjdkpkqil5zzlwh87h06ms6qzfx6nm3";
+    sha256 = "0ks5mm9hda5idivncyfpiz4lrd8fv0dpmsl711788k7f7ixdka3y";
   };
 
   prePatch = ''

From 5b5f9d23f4a8aae0131fd8338082a1cff4a7ed7b Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Wed, 5 Feb 2020 08:29:30 -0500
Subject: [PATCH 19/32] linux: 4.4.212 -> 4.4.213

---
 pkgs/os-specific/linux/kernel/linux-4.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 5409947c0a1..4ec9cdb5547 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.212";
+  version = "4.4.213";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0mx3qyj6w6h7gw7drsfsgl4iyz1695sjnf9hqh4kczci48kw5rj7";
+    sha256 = "1cmwn9zvz14jqjy6qkszglhs2p5h6yh82b2269cbzvibg8y3rxq0";
   };
 } // (args.argsOverride or {}))

From 447c14e62fa335f0eb391805dba99e6f0c57394f Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Wed, 5 Feb 2020 08:29:45 -0500
Subject: [PATCH 20/32] linux: 4.9.212 -> 4.9.213

---
 pkgs/os-specific/linux/kernel/linux-4.9.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index ff202b3fe9b..304f1464282 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.212";
+  version = "4.9.213";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0c5yjilaq86j6i2hzlxbp2ia7jhnf7kv952ffv7jxdf90sk3irxd";
+    sha256 = "0r7bqpvbpiiniwsm338b38mv6flfgm1r09avxqsakhkh8rvgz1dg";
   };
 } // (args.argsOverride or {}))

From ab0e69030e8d6cee22a05b2bb24f5ef4f3d8594f Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Wed, 5 Feb 2020 08:30:01 -0500
Subject: [PATCH 21/32] linux: 5.5.1 -> 5.5.2

---
 pkgs/os-specific/linux/kernel/linux-5.5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-5.5.nix b/pkgs/os-specific/linux/kernel/linux-5.5.nix
index 86654d133ab..52d1f6abca5 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.5.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5.1";
+  version = "5.5.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1n9hwzbhp43a4lvmyb0mbayfnb9s1h6nbg23i93wzg7391hr28q3";
+    sha256 = "17pr9v04g3lrar585l1zpnsmrivryqxwyfvjc3qp8wrkn21z7x94";
   };
 } // (args.argsOverride or {}))

From e9a21da6a1c1f4ecd3f40478dedd6d57ef903054 Mon Sep 17 00:00:00 2001
From: Tim Steinbach <tim@nequissimus.com>
Date: Wed, 5 Feb 2020 08:31:36 -0500
Subject: [PATCH 22/32] oh-my-zsh: 2020-02-04 -> 2020-02-04

---
 pkgs/shells/zsh/oh-my-zsh/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index ada885b974c..3cd8d2d4942 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
   version = "2020-02-04";
   pname = "oh-my-zsh";
-  rev = "6bebc254e88ac9b7fdaa7491d031f82ec107e418";
+  rev = "77aa1795d2f05583d4fc63a63abb0144beb5ecff";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "1lmg1givymr4hgmvmngklm7q3g7dpqwm7aj5xild72cdhx0g5qqw";
+    sha256 = "0n36wpdlr1w4gr0cja48mcywi8av71p3diigkiv3n45a9hh94fxx";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];

From 8e8285d9ca9ceb511d538bc2dd754e1017b1442e Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Mon, 3 Feb 2020 17:45:01 -0600
Subject: [PATCH 23/32] electron*: refactor 4+ to common expression, add 7,
 updates

* print-hashes.nix uses upstream-provided SHA256SUMS file
* electron_4: 4.2.8 -> 4.2.12
* electron_5: 5.0.8 -> 5.0.13
* electron_6: 6.0.1 -> 6.1.7
* electron_7:: init at 7.1.10

FWIW:
electron_4 previously did not include at-spi2-core, only at-spi2-atk.
Both are now included, matching other versions for a slightly simpler
expression.
---
 pkgs/development/tools/electron/5.x.nix       |  86 -------------
 pkgs/development/tools/electron/default.nix   | 116 +++++-------------
 .../tools/electron/{6.x.nix => generic.nix}   |  58 ++++-----
 .../tools/electron/print-hashes.sh            |  14 ++-
 pkgs/top-level/all-packages.nix               |   7 +-
 5 files changed, 71 insertions(+), 210 deletions(-)
 delete mode 100644 pkgs/development/tools/electron/5.x.nix
 rename pkgs/development/tools/electron/{6.x.nix => generic.nix} (53%)

diff --git a/pkgs/development/tools/electron/5.x.nix b/pkgs/development/tools/electron/5.x.nix
deleted file mode 100644
index 0b993ccf2a7..00000000000
--- a/pkgs/development/tools/electron/5.x.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }:
-
-let
-  version = "5.0.8";
-  name = "electron-${version}";
-
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-
-  meta = with stdenv.lib; {
-    description = "Cross platform desktop application shell";
-    homepage = https://github.com/electron/electron;
-    license = licenses.mit;
-    maintainers = with maintainers; [ travisbhartwell manveru ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
-  };
-
-  linux = {
-    inherit name version meta;
-    src = {
-      i686-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
-        sha256 = "1blw38x4fp4w2vs6r1d0jz3pg0m78417i0q9bvwpnwbn6wil857y";
-      };
-      x86_64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
-        sha256 = "1gz5n8gkgka7343qcwckagd4ply1lxwiaccdjv16srk2wwc9bc9m";
-      };
-      armv7l-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
-        sha256 = "1y8yna6z7xc378k6hsgngv9v98yjwq36knnr4qan0pw26paw1m82";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
-        sha256 = "1ha4ajvi0z051b6npigw6w4xi3bj3hhpxfr3xw4fgx6g6bvf1vpx";
-      };
-    }.${stdenv.hostPlatform.system} or throwSystem;
-
-    buildInputs = [ gtk3 ];
-
-    nativeBuildInputs = [
-      unzip
-      makeWrapper
-      wrapGAppsHook
-    ];
-
-    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
-
-    buildCommand = ''
-      mkdir -p $out/lib/electron $out/bin
-      unzip -d $out/lib/electron $src
-      ln -s $out/lib/electron/electron $out/bin
-
-      fixupPhase
-
-      patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk at-spi2-core ]}:$out/lib/electron" \
-        $out/lib/electron/electron
-
-      wrapProgram $out/lib/electron/electron \
-        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
-        "''${gappsWrapperArgs[@]}"
-    '';
-  };
-
-  darwin = {
-    inherit name version meta;
-
-    src = fetchurl {
-      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
-      sha256 = "1h7i2ik6wms5v6ji0mp33kzfh9sd89m7w3m2nm6wrjny7m0b43ww";
-    };
-
-    buildInputs = [ unzip ];
-
-    buildCommand = ''
-      mkdir -p $out/Applications
-      unzip $src
-      mv Electron.app $out/Applications
-      mkdir -p $out/bin
-      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
-    '';
-  };
-in
-
-  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 2efd97ebb1c..0e2ebd27f15 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -1,86 +1,38 @@
-{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk }:
+{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }@args:
 
 let
-  version = "4.2.8";
-  name = "electron-${version}";
-
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-
-  meta = with stdenv.lib; {
-    description = "Cross platform desktop application shell";
-    homepage = https://github.com/electron/electron;
-    license = licenses.mit;
-    maintainers = with maintainers; [ travisbhartwell manveru ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
-  };
-
-  linux = {
-    inherit name version meta;
-    src = {
-      i686-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
-        sha256 = "1sikxr0pfpi3wrf1d7fia1vhb1gacsy9pr7qc0fycgnzsy2nvf8n";
-      };
-      x86_64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
-        sha256 = "0wc954cjc13flvdh8rkmnifdx6nirf273v1n76lsklbsq6c73i4h";
-      };
-      armv7l-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
-        sha256 = "0370ygpsm42drm70gj12i6mg960wchhqis7zz8i9is2ax1b2xjp5";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
-        sha256 = "0vl90lsjcsgcxivbaq526ffbx3lsh6axfmpkfxl8cj2jlbsg593k";
-      };
-    }.${stdenv.hostPlatform.system} or throwSystem;
-
-    buildInputs = [ gtk3 ];
-
-    nativeBuildInputs = [
-      unzip
-      makeWrapper
-      wrapGAppsHook
-    ];
-
-    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
-
-    buildCommand = ''
-      mkdir -p $out/lib/electron $out/bin
-      unzip -d $out/lib/electron $src
-      ln -s $out/lib/electron/electron $out/bin
-
-      fixupPhase
-
-      patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk ]}:$out/lib/electron" \
-        $out/lib/electron/electron
-
-      wrapProgram $out/lib/electron/electron \
-        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
-        "''${gappsWrapperArgs[@]}"
-    '';
-  };
-
-  darwin = {
-    inherit name version meta;
-
-    src = fetchurl {
-      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
-      sha256 = "083v8k17b596fa63a7qrwyn2k8pd5vmg9yijbqbnpfcg4ja3bjx9";
-    };
-
-    buildInputs = [ unzip ];
-
-    buildCommand = ''
-      mkdir -p $out/Applications
-      unzip $src
-      mv Electron.app $out/Applications
-      mkdir -p $out/bin
-      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
-    '';
-  };
+  mkElectron = import ./generic.nix args;
 in
+{
+  electron_4 = mkElectron "4.2.12" {
+    x86_64-linux = "72c5319c92baa7101bea3254a036c0cd3bcf257f4a03a0bb153668b7292ee2dd";
+    x86_64-darwin = "89b0e16bb9b7072ed7ed1906fccd08540acdd9f42dd8a29c97fa17d811b8c5e5";
+    i686-linux = "bf96b1736141737bb064e48bdb543302fd259de634b1790b7cf930525f47859f";
+    armv7l-linux = "2d970b3020627e5381fd4916dd8fa50ca9556202c118ab4cba09c293960689e9";
+    aarch64-linux = "938b7cc5f917247a120920df30374f86414b0c06f9f3dc7ab02be1cadc944e55";
+  };
 
-  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
+  electron_5 = mkElectron "5.0.13" {
+    x86_64-linux = "8ded43241c4b7a6f04f2ff21c75ae10e4e6db1794e8b1b4f7656c0ed21667f8f";
+    x86_64-darwin = "589834815fb9667b3c1c1aa6ccbd87d50e5660ecb430f6b475168b772b9857cd";
+    i686-linux = "ccf4a5ed226928a30bd3ea830913d99853abb089bd4a6299ffa9fa0daa8d026a";
+    armv7l-linux = "96ad83802bc61d87bb952027d49e5dd297f58e4493e66e393b26e51e09065add";
+    aarch64-linux = "01f0fd313b060fb28a1022d68fb224d415fa22986e2a8f4aded6424b65e35add";
+  };
+
+  electron_6 = mkElectron "6.1.7" {
+    x86_64-linux = "7fe94fc1edebe2f5645056a4300fc642c04155e55da8dd4ee058a0c0ef835ae8";
+    x86_64-darwin = "1c790a4cbda05f1c136d18fa6a09bdb09a1941f521207466756a3e95e343c485";
+    i686-linux = "1afd8ea79acb2b4782fb459e084549ed4cd4ead779764829b1d862148359eae5";
+    armv7l-linux = "14f2ea0459f0dda8c566b0fa4a2fe755f4220bbae313ea0c453861ac2f803196";
+    aarch64-linux = "80e05c1a0b51c335483666e959c1631a089246986b7fc3a4f9ee1288a57a602a";
+  };
+
+  electron_7 = mkElectron "7.1.10" {
+    x86_64-linux = "296f034ac9a00afa4dc99ed145410c015af3f59cd7e9becc7709d70a4f8a9ebf";
+    x86_64-darwin = "10eb453c2b19948777a6f404fbdbdd48464a4cd63db16bd3ce66b60dda016724";
+    i686-linux = "681b6440d4f0f7ffa29a34610ef41103d72937d6e524d81fd2d0fa8d9eb67936";
+    armv7l-linux = "2c09e9a77f1da152d766dc2e43719e2852b70f917229466a2ac457416d1374f7";
+    aarch64-linux = "1dad780b872bbc069eb1cac9ff4ec8f0b8d200153ab7f51397e27219094db1f0";
+  };
+}
diff --git a/pkgs/development/tools/electron/6.x.nix b/pkgs/development/tools/electron/generic.nix
similarity index 53%
rename from pkgs/development/tools/electron/6.x.nix
rename to pkgs/development/tools/electron/generic.nix
index 5d412848d2d..b2ce076933d 100644
--- a/pkgs/development/tools/electron/6.x.nix
+++ b/pkgs/development/tools/electron/generic.nix
@@ -1,11 +1,9 @@
 { stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core}:
 
+version: hashes:
 let
-  version = "6.0.1";
   name = "electron-${version}";
 
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-
   meta = with stdenv.lib; {
     description = "Cross platform desktop application shell";
     homepage = https://github.com/electron/electron;
@@ -14,27 +12,28 @@ let
     platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
   };
 
-  linux = {
-    inherit name version meta;
-    src = {
-      i686-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
-        sha256 = "0ly6mjcljw0axkkrz7dsvfywmjb3pmspalfk2259gyqqxj8a37pb";
-      };
-      x86_64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
-        sha256 = "0l8k6v16ynikf6x59w5byzhji0d6mqp2q0kjlrby56546qzyfkh6";
-      };
-      armv7l-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
-        sha256 = "0c2xl8dm9fmj0d92w53zbn2np2fiwr88hw0dqjdn1rwczhw7zqss";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
-        sha256 = "0iyq229snm7z411xxfsv7f0bqg6hbw2l8y6ymys110f83hp01f8a";
-      };
-    }.${stdenv.hostPlatform.system} or throwSystem;
+  fetcher = vers: tag: hash: fetchurl {
+    url = "https://github.com/electron/electron/releases/download/v${vers}/electron-v${vers}-${tag}.zip";
+    sha256 = hash;
+  };
 
+  tags = {
+    i686-linux = "linux-ia32";
+    x86_64-linux = "linux-x64";
+    armv7l-linux = "linux-armv7l";
+    aarch64-linux = "linux-arm64";
+    x86_64-darwin = "darwin-x64";
+  };
+
+  get = as: platform: as.${platform.system} or
+    "Unsupported system: ${platform.system}";
+
+  common = platform: {
+    inherit name version meta;
+    src = fetcher version (get tags platform) (get hashes platform);
+  };
+
+  linux = {
     buildInputs = [ gtk3 ];
 
     nativeBuildInputs = [
@@ -64,13 +63,6 @@ let
   };
 
   darwin = {
-    inherit name version meta;
-
-    src = fetchurl {
-      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
-      sha256 = "0m8v5fs69kanrd1yk6smbmaaj9gb5j3q487z3wicifry0xn381i2";
-    };
-
     buildInputs = [ unzip ];
 
     buildCommand = ''
@@ -82,5 +74,7 @@ let
     '';
   };
 in
-
-  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
+  stdenv.mkDerivation (
+    (common stdenv.hostPlatform) //
+    (if stdenv.isDarwin then darwin else linux)
+  )
diff --git a/pkgs/development/tools/electron/print-hashes.sh b/pkgs/development/tools/electron/print-hashes.sh
index 203e5a4dfec..45656a8f7b2 100755
--- a/pkgs/development/tools/electron/print-hashes.sh
+++ b/pkgs/development/tools/electron/print-hashes.sh
@@ -19,11 +19,15 @@ SYSTEMS=(
     [x86_64-darwin]=darwin-x64
 )
 
+hashfile="$(nix-prefetch-url --print-path "https://github.com/electron/electron/releases/download/v${VERSION}/SHASUMS256.txt" 2>/dev/null | tail -n1)"
+
+echo "Entry similar to the following goes in default.nix:"
+echo
+echo "  electron_${VERSION%%.*} = mkElectron \"${VERSION}\" {"
+
 for S in "${!SYSTEMS[@]}"; do
-  HASHES["$S"]=$(nix-prefetch-url "https://github.com/electron/electron/releases/download/v${VERSION}/electron-v${VERSION}-${SYSTEMS[$S]}.zip")
+  hash="$(grep " *electron-v${VERSION}-${SYSTEMS[$S]}.zip$" "$hashfile"|cut -f1 -d' ')"
+  echo "    $S = \"$hash\";"
 done
 
-for S in "${!HASHES[@]}"; do
-    echo "$S"
-    echo "sha256 = \"${HASHES[$S]}\";"
-done
+echo "  };"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a8bf22e01c7..03ded835076 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9669,11 +9669,8 @@ in
 
   aws-adfs = with python3Packages; toPythonApplication aws-adfs;
 
-  electron_6 = callPackage ../development/tools/electron/6.x.nix { };
-
-  electron_5 = callPackage ../development/tools/electron/5.x.nix { };
-
-  electron_4 = callPackage ../development/tools/electron { };
+  inherit (callPackages ../development/tools/electron { })
+    electron_4 electron_5 electron_6 electron_7;
 
   electron_3 = callPackage ../development/tools/electron/3.x.nix { };
   electron = electron_4;

From ed8c6393d01778a661db08a8e797ac11fb8cb1ed Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Mon, 3 Feb 2020 22:37:52 -0600
Subject: [PATCH 24/32] electron_8: init at 8.0.0

---
 pkgs/development/tools/electron/default.nix | 8 ++++++++
 pkgs/top-level/all-packages.nix             | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 0e2ebd27f15..d23c5a663e6 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -35,4 +35,12 @@ in
     armv7l-linux = "2c09e9a77f1da152d766dc2e43719e2852b70f917229466a2ac457416d1374f7";
     aarch64-linux = "1dad780b872bbc069eb1cac9ff4ec8f0b8d200153ab7f51397e27219094db1f0";
   };
+
+  electron_8 = mkElectron "8.0.0" {
+    x86_64-linux = "b457a2ece83bb8a2efea42e75403740cbba051a64e325288760046b8999dd1c9";
+    x86_64-darwin = "3f96dfa1d4e0313d11b9e5c66e2df161cfdb30685ee9dadcc779bcad2fb3876e";
+    i686-linux = "0633ac2b6b6d00302e0e5df224d0e808e4ea9ecc14643e8534027e49b20436fb";
+    armv7l-linux = "8d1f3daa86c77e7aceb8c8e4491c094e789951c7d475fc536b85fe7d279794bf";
+    aarch64-linux = "484c04204478e8594d66f8bd332529c0c5eecfd71ee1705cc0478fa59c6818ee";
+  };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 03ded835076..cadc14be9f5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9670,7 +9670,7 @@ in
   aws-adfs = with python3Packages; toPythonApplication aws-adfs;
 
   inherit (callPackages ../development/tools/electron { })
-    electron_4 electron_5 electron_6 electron_7;
+    electron_4 electron_5 electron_6 electron_7 electron_8;
 
   electron_3 = callPackage ../development/tools/electron/3.x.nix { };
   electron = electron_4;

From 696829ff697686bea170fd8c808ee61b7f4bdd8d Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 5 Feb 2020 16:37:19 +0100
Subject: [PATCH 25/32] documize-community: 3.6.0 -> 3.7.0

https://github.com/documize/community/releases/tag/v3.7.0
---
 pkgs/servers/documize-community/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/documize-community/default.nix b/pkgs/servers/documize-community/default.nix
index 078936b237f..0607902295a 100644
--- a/pkgs/servers/documize-community/default.nix
+++ b/pkgs/servers/documize-community/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "documize-community";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "documize";
     repo = "community";
     rev = "v${version}";
-    sha256 = "0wic4j7spw9ya1m6yz0mkpqi1px6jd2vk60w8ldx0m0k606wy6ir";
+    sha256 = "1pcldf9lqvpb2h2a3kr3mahj2v1jasjwrszj6czjmkyml7x2sz7c";
   };
 
   modSha256 = "1z0v7n8klaxcqv7mvzf3jzgrp78zb4yiibx899ppk6i5qnj4xiv0";

From f8a0576f6ced8fd19c279c4f0d6ba12aab394bc7 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 5 Feb 2020 16:47:41 +0100
Subject: [PATCH 26/32] linuxPackages.wireguard: 0.0.20200128 -> 0.0.20200205

https://lists.zx2c4.com/pipermail/wireguard/2020-February/004962.html
---
 pkgs/os-specific/linux/wireguard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 247fd8ed250..f0c3de0229a 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "0.0.20200128";
+  version = "0.0.20200205";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "05iz0pl0znx5yham8qzpym2ggc9babh36xaa504k99qqvddg8b11";
+    sha256 = "084bvjhfqxvbh5wv7a2cj8k1i1lfix2l9972xwr36hw9kvqpynnm";
   };
 
   preConfigure = ''

From e3edb004c6d62b191d70506f3f99bbf845ce1b52 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 5 Feb 2020 16:53:40 +0100
Subject: [PATCH 27/32] knot-resolver: 5.0.0 -> 5.0.1

https://gitlab.labs.nic.cz/knot/knot-resolver/tags/v5.0.1
---
 pkgs/servers/dns/knot-resolver/default.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 29088e60153..c1c826b7812 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -16,23 +16,15 @@ lua = luajitPackages;
 
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "ca6023cd0c18b11f4a0cff0c8e882c7f3a5ad6653e9aa95acdbedafc5a53a5ed";
+    sha256 = "4a93264ad0cda7ea2252d1ba057e474722f77848165f2893e0c76e21ae406415";
   };
 
   outputs = [ "out" "dev" ];
 
-  patches = [
-    (fetchpatch { # TODO: included in the next release.
-      name = "fix-GC-path.patch";
-      url = "https://gitlab.labs.nic.cz/knot/knot-resolver/commit/b723dbbe0.diff";
-      sha256 = "1hrwbv9vjybnwm083jxcinzw3fmwlsf1dgxrly7mhjs8d3jhqc4z";
-    })
-  ];
-
   # Path fixups for the NixOS service.
   postPatch = ''
     patch meson.build <<EOF

From fc3bd1aeb9ac59c3085b8dfc662237b310248d5e Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Wed, 5 Feb 2020 18:09:37 +0100
Subject: [PATCH 28/32] lib/strings: fix comment typo

---
 lib/strings.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/strings.nix b/lib/strings.nix
index 6dbb3d3a3e8..4f9509ffe7c 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -244,7 +244,7 @@ rec {
      Also note that Nix treats strings as a list of bytes and thus doesn't
      handle unicode.
 
-     Type: stringtoCharacters :: string -> [string]
+     Type: stringToCharacters :: string -> [string]
 
      Example:
        stringToCharacters ""

From ccc64216ddf1e15fb801d742d33a8205dffbb65a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 5 Feb 2020 18:22:33 +0100
Subject: [PATCH 29/32] vagrant: 2.2.6 -> 2.2.7

https://github.com/hashicorp/vagrant/releases/tag/v2.2.7
---
 pkgs/development/tools/vagrant/default.nix | 16 ++++++++---
 pkgs/development/tools/vagrant/gemset.nix  | 32 +++++++++++-----------
 2 files changed, 28 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index ea3382f3e70..ee810012862 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -1,12 +1,13 @@
 { stdenv, lib, fetchurl, buildRubyGem, bundlerEnv, ruby, libarchive
-, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux }:
+, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux, fetchpatch
+}:
 
 let
   # NOTE: bumping the version and updating the hash is insufficient;
   # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.6";
+  version = "2.2.7";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "0nssq2i4riif0q72h5qp7dlxd4shqcyvm1bx9adppcacb77gpnhv";
+  sha256 = "1z31y1nqiyj6rml9lz8gcbr29myhs5wcap8jsvgm3pb7p9p9y8m9";
 
   deps = bundlerEnv rec {
     name = "${pname}-${version}";
@@ -53,6 +54,13 @@ in buildRubyGem rec {
     ./unofficial-installation-nowarn.patch
     ./use-system-bundler-version.patch
     ./0004-Support-system-installed-plugins.patch
+
+    # fix deprecation warning on ruby 2.6.5.
+    # See also https://github.com/hashicorp/vagrant/pull/11307
+    (fetchpatch {
+      url = "https://github.com/hashicorp/vagrant/commit/d18ed567aaa5da23c9e91ab87f360e7bf6760f13.patch";
+      sha256 = "0f61qj41rc3fdggmnha4jrqg4pzmfiriwpsz4fcgf7c0bx6qha7q";
+    })
   ];
 
   postPatch = ''
@@ -110,7 +118,7 @@ in buildRubyGem rec {
     description = "A tool for building complete development environments";
     homepage = https://www.vagrantup.com/;
     license = licenses.mit;
-    maintainers = with maintainers; [ aneeshusa ];
+    maintainers = with maintainers; [ aneeshusa ma27 ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/tools/vagrant/gemset.nix b/pkgs/development/tools/vagrant/gemset.nix
index f9aebbe6996..64f24f8270d 100644
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@@ -14,10 +14,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
+      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
       type = "gem";
     };
-    version = "3.2.3";
+    version = "3.2.4";
   };
   childprocess = {
     dependencies = ["ffi"];
@@ -86,10 +86,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06mvxpjply8qh4j3fj9wh08kdzwkbnvsiysh0vrhlk5cwxzjmblh";
+      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
       type = "gem";
     };
-    version = "1.11.1";
+    version = "1.12.2";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -150,10 +150,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gcp1m1p6dpasycfz2sj82ci9ggz7lsskz9c9q6gvfwxrl8y9dx7";
+      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "1.8.2";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
@@ -203,10 +203,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g7l18igjb9z7q4b2ykvyxyvjxlx5pwsmx5z3ibdbr6372xgfglk";
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
       type = "gem";
     };
-    version = "3.3";
+    version = "3.3.1";
   };
   mime-types-data = {
     groups = ["default"];
@@ -296,10 +296,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fs7hxm9g6ywv2yih83b879klhc4fs8i0p9166z795qmd77dk0a4";
+      sha256 = "1jm76h8f8hji38z3ggf4bzi8vps6p7sagxn3ab57qc0xyga64005";
       type = "gem";
     };
-    version = "0.10.0";
+    version = "0.10.1";
   };
   rb-kqueue = {
     dependencies = ["ffi"];
@@ -348,10 +348,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0i5dhyiavmk2yc7xyfwzp3m476f7d9mhigibsw37jqpdq4vmi4cv";
+      sha256 = "1qxc2zxwwipm6kviiar4gfhcakpx1jdcs89v6lvzivn5hq1xk78l";
       type = "gem";
     };
-    version = "1.2.4";
+    version = "1.3.0";
   };
   unf = {
     dependencies = ["unf_ext"];
@@ -401,10 +401,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sl14qdshkmficdsy9z57xmdp5z9riv7jc5lv005n0h04mg7d47b";
+      sha256 = "13c0vf32vinkp3ia86rvq779dacl37v4v2814v4g9qrk3liv0dym";
       type = "gem";
     };
-    version = "2.3.3";
+    version = "2.3.4";
   };
   winrm-elevated = {
     dependencies = ["erubi" "winrm" "winrm-fs"];
@@ -412,10 +412,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13d0pjzffbqicg08fsx4dsl6ibsqda5vx5d9f6hsds2z6mdilrab";
+      sha256 = "12fzg9liydl244xq6r7x0wy06zn1n4czdbnjavy3150c3qsnv71a";
       type = "gem";
     };
-    version = "1.1.2";
+    version = "1.2.0";
   };
   winrm-fs = {
     dependencies = ["erubi" "logging" "rubyzip" "winrm"];

From f720f1413755ea9fcc7915fd5a87bf1f0c2a2dfa Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 5 Feb 2020 19:07:43 +0100
Subject: [PATCH 30/32] python3Packages.dask: 2.9.1 -> 2.10.1

---
 pkgs/development/python-modules/dask/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index beef26ec5be..ef47f419a6e 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2.9.1";
+  version = "2.10.1";
 
   disabled = pythonOlder "3.5";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = version;
-    sha256 = "1xayr4gkp4slvmh2ksdr0d196giz3yhknqjjg1vw2j0la9gwfwxs";
+    sha256 = "035mr7385yf5ng5wf60qxr80529h8dsla5hymkyg68dxhkd0jvbr";
   };
 
   checkInputs = [

From 0be87c79797a5fa384fbc356c74ed54f9f7829ea Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 5 Feb 2020 19:18:11 +0100
Subject: [PATCH 31/32] Revert "Merge master into staging-next"

I merged master into staging-next but accidentally pushed it to master.
This should get us back to 87a19e9048773d5a363679617406ad148d36c3b8.

This reverts commit ac241fb7a570d6cf81d229ad22a8889602639160, reversing
changes made to 76a439239eb310d9ad76d998b34d5d3bc0e37acb.
---
 lib/strings.nix                               |   2 +-
 nixos/modules/installer/cd-dvd/iso-image.nix  |  14 +-
 nixos/modules/installer/netboot/netboot.nix   |  14 +-
 nixos/modules/misc/ids.nix                    |   4 +-
 nixos/modules/services/networking/kresd.nix   | 150 ++++++++++--------
 nixos/modules/system/boot/stage-1-init.sh     |  13 +-
 nixos/tests/lorri/default.nix                 |   6 +-
 .../graphics/paraview/default.nix             |  24 +--
 .../science/biology/spades/default.nix        |   4 +-
 pkgs/development/libraries/imlib2/default.nix |  35 ++--
 .../python-modules/dask/default.nix           |   4 +-
 pkgs/development/tools/electron/5.x.nix       |  86 ++++++++++
 .../tools/electron/{generic.nix => 6.x.nix}   |  58 ++++---
 pkgs/development/tools/electron/default.nix   | 124 ++++++++++-----
 .../tools/electron/print-hashes.sh            |  14 +-
 pkgs/development/tools/vagrant/default.nix    |  16 +-
 pkgs/development/tools/vagrant/gemset.nix     |  32 ++--
 pkgs/os-specific/linux/kernel/linux-4.4.nix   |   4 +-
 pkgs/os-specific/linux/kernel/linux-4.9.nix   |   4 +-
 pkgs/os-specific/linux/kernel/linux-5.5.nix   |   4 +-
 pkgs/os-specific/linux/wireguard/default.nix  |   4 +-
 pkgs/servers/dns/knot-resolver/default.nix    |  70 ++++----
 pkgs/servers/documize-community/default.nix   |   4 +-
 pkgs/shells/zsh/oh-my-zsh/default.nix         |   4 +-
 pkgs/tools/misc/lorri/default.nix             |   8 +-
 pkgs/tools/security/sequoia/default.nix       |   6 +-
 pkgs/tools/security/sudo/default.nix          |   4 +-
 pkgs/top-level/all-packages.nix               |   7 +-
 28 files changed, 422 insertions(+), 297 deletions(-)
 create mode 100644 pkgs/development/tools/electron/5.x.nix
 rename pkgs/development/tools/electron/{generic.nix => 6.x.nix} (53%)

diff --git a/lib/strings.nix b/lib/strings.nix
index 4f9509ffe7c..6dbb3d3a3e8 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -244,7 +244,7 @@ rec {
      Also note that Nix treats strings as a list of bytes and thus doesn't
      handle unicode.
 
-     Type: stringToCharacters :: string -> [string]
+     Type: stringtoCharacters :: string -> [string]
 
      Example:
        stringToCharacters ""
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 4558b4dc955..11319e5f4f8 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -569,18 +569,14 @@ in
       };
 
     fileSystems."/nix/store" =
-      { fsType = "overlay";
-        device = "overlay";
-        options = [
-          "lowerdir=/nix/.ro-store"
-          "upperdir=/nix/.rw-store/store"
-          "workdir=/nix/.rw-store/work"
-        ];
+      { fsType = "unionfs-fuse";
+        device = "unionfs";
+        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
       };
 
-    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" "overlay" ];
+    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" ];
 
-    boot.initrd.kernelModules = [ "loop" "overlay" ];
+    boot.initrd.kernelModules = [ "loop" ];
 
     # Closures to be copied to the Nix store on the CD, namely the init
     # script and the top-level system configuration directory.
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index 95eba86bcb6..5146858cccf 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -50,18 +50,14 @@ with lib;
       };
 
     fileSystems."/nix/store" =
-      { fsType = "overlay";
-        device = "overlay";
-        options = [
-          "lowerdir=/nix/.ro-store"
-          "upperdir=/nix/.rw-store/store"
-          "workdir=/nix/.rw-store/work"
-        ];
+      { fsType = "unionfs-fuse";
+        device = "unionfs";
+        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
       };
 
-    boot.initrd.availableKernelModules = [ "squashfs" "overlay" ];
+    boot.initrd.availableKernelModules = [ "squashfs" ];
 
-    boot.initrd.kernelModules = [ "loop" "overlay" ];
+    boot.initrd.kernelModules = [ "loop" ];
 
     # Closures to be copied to the Nix store, namely the init
     # script and the top-level system configuration directory.
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index 979cdc5d4ad..bedd87a368e 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -299,7 +299,7 @@ in
       couchpotato = 267;
       gogs = 268;
       pdns-recursor = 269;
-      #kresd = 270; # switched to "knot-resolver" with dynamic ID
+      kresd = 270;
       rpc = 271;
       geoip = 272;
       fcron = 273;
@@ -600,7 +600,7 @@ in
       headphones = 266;
       couchpotato = 267;
       gogs = 268;
-      #kresd = 270; # switched to "knot-resolver" with dynamic ID
+      kresd = 270;
       #rpc = 271; # unused
       #geoip = 272; # unused
       fcron = 273;
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index a2f91a4200b..bb941e93e15 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -3,34 +3,12 @@
 with lib;
 
 let
+
   cfg = config.services.kresd;
-
-  # Convert systemd-style address specification to kresd config line(s).
-  # On Nix level we don't attempt to precisely validate the address specifications.
-  mkListen = kind: addr: let
-    al_v4 = builtins.match "([0-9.]\+):([0-9]\+)" addr;
-    al_v6 = builtins.match "\\[(.\+)]:([0-9]\+)" addr;
-    al_portOnly = builtins.match "()([0-9]\+)" addr;
-    al = findFirst (a: a != null)
-      (throw "services.kresd.*: incorrect address specification '${addr}'")
-      [ al_v4 al_v6 al_portOnly ];
-    port = last al;
-    addrSpec = if al_portOnly == null then "'${head al}'" else "{'::', '127.0.0.1'}";
-    in # freebind is set for compatibility with earlier kresd services;
-       # it could be configurable, for example.
-      ''
-        net.listen(${addrSpec}, ${port}, { kind = '${kind}', freebind = true })
-      '';
-
-  configFile = pkgs.writeText "kresd.conf" (
-    optionalString (cfg.listenDoH != []) ''
-      modules.load('http')
-    ''
-    + concatMapStrings (mkListen "dns") cfg.listenPlain
-    + concatMapStrings (mkListen "tls") cfg.listenTLS
-    + concatMapStrings (mkListen "doh") cfg.listenDoH
-    + cfg.extraConfig
-  );
+  configFile = pkgs.writeText "kresd.conf" ''
+    ${optionalString (cfg.listenDoH != []) "modules.load('http')"}
+    ${cfg.extraConfig};
+  '';
 
   package = pkgs.knot-resolver.override {
     extraFeatures = cfg.listenDoH != [];
@@ -47,7 +25,6 @@ in {
           value
       )
     )
-    (mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
   ];
 
   ###### interface
@@ -58,8 +35,8 @@ in {
       description = ''
         Whether to enable knot-resolver domain name server.
         DNSSEC validation is turned on by default.
-        You can run <literal>sudo nc -U /run/knot-resolver/control/1</literal>
-        and give commands interactively to kresd@1.service.
+        You can run <literal>sudo nc -U /run/kresd/control</literal>
+        and give commands interactively to kresd.
       '';
     };
     extraConfig = mkOption {
@@ -69,10 +46,16 @@ in {
         Extra lines to be added verbatim to the generated configuration file.
       '';
     };
+    cacheDir = mkOption {
+      type = types.path;
+      default = "/var/cache/kresd";
+      description = ''
+        Directory for caches.  They are intended to survive reboots.
+      '';
+    };
     listenPlain = mkOption {
       type = with types; listOf str;
       default = [ "[::1]:53" "127.0.0.1:53" ];
-      example = [ "53" ];
       description = ''
         What addresses and ports the server should listen on.
         For detailed syntax see ListenStream in man systemd.socket.
@@ -92,54 +75,91 @@ in {
       default = [];
       example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
       description = ''
-        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 8484).
+        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 7858).
         For detailed syntax see ListenStream in man systemd.socket.
       '';
     };
-    instances = mkOption {
-      type = types.ints.unsigned;
-      default = 1;
-      description = ''
-        The number of instances to start.  They will be called kresd@{1,2,...}.service.
-        Knot Resolver uses no threads, so this is the way to scale.
-        You can dynamically start/stop them at will, so this is just system default.
-      '';
-    };
     # TODO: perhaps options for more common stuff like cache size or forwarding
   };
 
   ###### implementation
   config = mkIf cfg.enable {
-    environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
+    environment.etc."kresd.conf".source = configFile; # not required
 
-    users.users.knot-resolver =
-      { isSystemUser = true;
-        group = "knot-resolver";
+    users.users.kresd =
+      { uid = config.ids.uids.kresd;
+        group = "kresd";
         description = "Knot-resolver daemon user";
       };
-    users.groups.knot-resolver.gid = null;
+    users.groups.kresd.gid = config.ids.gids.kresd;
 
-    systemd.packages = [ package ]; # the units are patched inside the package a bit
-
-    systemd.targets.kresd = { # configure units started by default
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "kres-cache-gc.service" ]
-        ++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
-    };
-    systemd.services."kresd@".serviceConfig = {
-      ExecStart = "${package}/bin/kresd --noninteractive "
-        + "-c ${package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
-      # Ensure correct ownership in case UID or GID changes.
-      CacheDirectory = "knot-resolver";
-      CacheDirectoryMode = "0750";
+    systemd.sockets.kresd = rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      listenStreams = cfg.listenPlain;
+      socketConfig = {
+        ListenDatagram = listenStreams;
+        FreeBind = true;
+        FileDescriptorName = "dns";
+      };
     };
 
-    environment.etc."tmpfiles.d/knot-resolver.conf".source =
-      "${package}/lib/tmpfiles.d/knot-resolver.conf";
+    systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      partOf = [ "kresd.socket" ];
+      listenStreams = cfg.listenTLS;
+      socketConfig = {
+        FileDescriptorName = "tls";
+        FreeBind = true;
+        Service = "kresd.service";
+      };
+    };
 
-    # Try cleaning up the previously default location of cache file.
-    # Note that /var/cache/* should always be safe to remove.
-    # TODO: remove later, probably between 20.09 and 21.03
-    systemd.tmpfiles.rules = [ "R /var/cache/kresd" ];
+    systemd.sockets.kresd-doh = mkIf (cfg.listenDoH != []) rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      partOf = [ "kresd.socket" ];
+      listenStreams = cfg.listenDoH;
+      socketConfig = {
+        FileDescriptorName = "doh";
+        FreeBind = true;
+        Service = "kresd.service";
+      };
+    };
+
+    systemd.sockets.kresd-control = rec {
+      wantedBy = [ "sockets.target" ];
+      before = wantedBy;
+      partOf = [ "kresd.socket" ];
+      listenStreams = [ "/run/kresd/control" ];
+      socketConfig = {
+        FileDescriptorName = "control";
+        Service = "kresd.service";
+        SocketMode = "0660"; # only root user/group may connect and control kresd
+      };
+    };
+
+    systemd.tmpfiles.rules = [ "d '${cfg.cacheDir}' 0770 kresd kresd - -" ];
+
+    systemd.services.kresd = {
+      description = "Knot-resolver daemon";
+
+      serviceConfig = {
+        User = "kresd";
+        Type = "notify";
+        WorkingDirectory = cfg.cacheDir;
+        Restart = "on-failure";
+        Sockets = [ "kresd.socket" "kresd-control.socket" ]
+          ++ optional (cfg.listenTLS != []) "kresd-tls.socket";
+      };
+
+      # Trust anchor goes from dns-root-data by default.
+      script = ''
+        exec '${package}/bin/kresd' --config '${configFile}' --forks=1
+      '';
+
+      requires = [ "kresd.socket" ];
+    };
   };
 }
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index 8736613c3d2..f520bf54ad1 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -334,10 +334,8 @@ mountFS() {
 
     # Filter out x- options, which busybox doesn't do yet.
     local optionsFiltered="$(IFS=,; for i in $options; do if [ "${i:0:2}" != "x-" ]; then echo -n $i,; fi; done)"
-    # Prefix (lower|upper|work)dir with /mnt-root (overlayfs)
-    local optionsPrefixed="$( echo "$optionsFiltered" | sed -E 's#\<(lowerdir|upperdir|workdir)=#\1=/mnt-root#g' )"
 
-    echo "$device /mnt-root$mountPoint $fsType $optionsPrefixed" >> /etc/fstab
+    echo "$device /mnt-root$mountPoint $fsType $optionsFiltered" >> /etc/fstab
 
     checkFS "$device" "$fsType"
 
@@ -356,11 +354,10 @@ mountFS() {
             ;;
     esac
 
-    # Create backing directories for overlayfs
-    if [ "$fsType" = overlay ]; then
-        for i in upper work; do
-             dir="$( echo "$optionsPrefixed" | grep -o "${i}dir=[^,]*" )"
-             mkdir -m 0700 -p "${dir##*=}"
+    # Create backing directories for unionfs-fuse.
+    if [ "$fsType" = unionfs-fuse ]; then
+        for i in $(IFS=:; echo ${options##*,dirs=}); do
+            mkdir -m 0700 -p /mnt-root"${i%=*}"
         done
     fi
 
diff --git a/nixos/tests/lorri/default.nix b/nixos/tests/lorri/default.nix
index 198171082d8..53074385a65 100644
--- a/nixos/tests/lorri/default.nix
+++ b/nixos/tests/lorri/default.nix
@@ -15,12 +15,12 @@ import ../make-test-python.nix {
 
     # Start the daemon and wait until it is ready
     machine.execute("lorri daemon > lorri.stdout 2> lorri.stderr &")
-    machine.wait_until_succeeds("grep --fixed-strings 'ready' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'lorri: ready' lorri.stdout")
 
     # Ping the daemon
-    machine.succeed("lorri internal__ping shell.nix")
+    machine.execute("lorri ping_ $(readlink -f shell.nix)")
 
     # Wait for the daemon to finish the build
-    machine.wait_until_succeeds("grep --fixed-strings 'Completed' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'OutputPaths' lorri.stdout")
   '';
 }
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index ac01c28ebd4..d0351e98ee0 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -1,5 +1,9 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, qtbase , qttools, python
-, libGLU, libGL , libXt, qtx11extras, qtxmlpatterns , mkDerivation }:
+{
+stdenv, fetchFromGitHub, cmake, makeWrapper
+,qtbase, qttools, python, libGLU, libGL
+,libXt, qtx11extras, qtxmlpatterns
+, mkDerivation
+}:
 
 mkDerivation rec {
   pname = "paraview";
@@ -49,20 +53,20 @@ mkDerivation rec {
 
   # Paraview links into the Python library, resolving symbolic links on the way,
   # so we need to put the correct sitePackages (with numpy) back on the path
-  preFixup = ''
-    wrapQtApp $out/bin/paraview \
+  postInstall = ''
+    wrapProgram $out/bin/paraview \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapQtApp $out/bin/pvbatch \
+    wrapProgram $out/bin/pvbatch \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapQtApp $out/bin/pvpython \
+    wrapProgram $out/bin/pvpython \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
   '';
 
-  meta = with stdenv.lib; {
+  meta = {
     homepage = http://www.paraview.org/;
     description = "3D Data analysis and visualization application";
-    license = licenses.free;
-    maintainers = with maintainers; [ guibert ];
-    platforms = platforms.linux;
+    license = stdenv.lib.licenses.free;
+    maintainers = with stdenv.lib.maintainers; [guibert];
+    platforms = with stdenv.lib.platforms; linux;
   };
 }
diff --git a/pkgs/applications/science/biology/spades/default.nix b/pkgs/applications/science/biology/spades/default.nix
index 08a6a0d2509..a195f79010a 100644
--- a/pkgs/applications/science/biology/spades/default.nix
+++ b/pkgs/applications/science/biology/spades/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "SPAdes";
-  version = "3.14.0";
+  version = "3.13.1";
 
   src = fetchurl {
     url = "http://cab.spbu.ru/files/release${version}/${pname}-${version}.tar.gz";
-    sha256 = "1ffxswd2ngkpy1d6l3lb6a9cmyy1fglbdsws00b3m1k22zaqv60q";
+    sha256 = "0giayz197lmq2108filkn9izma3i803sb3iskv9hs5snzdr9p8ld";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 36b1063531e..2576580908a 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -1,28 +1,19 @@
-{ stdenv, fetchurl
-# Image file formats
-, libjpeg, libtiff, giflib, libpng, libwebp
-# imlib2 can load images from ID3 tags.
-, libid3tag
-, freetype , bzip2, pkgconfig
-, x11Support ? true, xlibsWrapper ? null
-}:
+{ stdenv, fetchurl, libjpeg, libtiff, giflib, libpng, bzip2, pkgconfig
+, freetype, libid3tag
+, x11Support ? true, xlibsWrapper ? null }:
+
+with stdenv.lib;
 
-let
-  inherit (stdenv.lib) optional;
-in
 stdenv.mkDerivation rec {
-  pname = "imlib2";
-  version = "1.6.1";
+  name = "imlib2-1.5.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.bz2";
-    sha256 = "0v8n3dswx7rxqfd0q03xwc7j2w1mv8lv18rdxv487a1xw5vklfad";
+    url = "mirror://sourceforge/enlightenment/${name}.tar.bz2";
+    sha256 = "1bms2iwmvnvpz5jqq3r52glarqkafif47zbh1ykz8hw85d2mfkps";
   };
 
-  buildInputs = [
-    libjpeg libtiff giflib libpng libwebp
-    bzip2 freetype libid3tag
-  ] ++ optional x11Support xlibsWrapper;
+  buildInputs = [ libjpeg libtiff giflib libpng bzip2 freetype libid3tag ]
+    ++ optional x11Support xlibsWrapper;
 
   nativeBuildInputs = [ pkgconfig ];
 
@@ -44,7 +35,7 @@ stdenv.mkDerivation rec {
     moveToOutput bin/imlib2-config "$dev"
   '';
 
-  meta = with stdenv.lib; {
+  meta = {
     description = "Image manipulation library";
 
     longDescription = ''
@@ -55,8 +46,8 @@ stdenv.mkDerivation rec {
       easily, without sacrificing speed.
     '';
 
-    homepage = "https://docs.enlightenment.org/api/imlib2/html";
-    license = licenses.mit;
+    homepage = http://docs.enlightenment.org/api/imlib2/html;
+    license = licenses.free;
     platforms = platforms.unix;
     maintainers = with maintainers; [ spwhitt ];
   };
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index ef47f419a6e..beef26ec5be 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2.10.1";
+  version = "2.9.1";
 
   disabled = pythonOlder "3.5";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = version;
-    sha256 = "035mr7385yf5ng5wf60qxr80529h8dsla5hymkyg68dxhkd0jvbr";
+    sha256 = "1xayr4gkp4slvmh2ksdr0d196giz3yhknqjjg1vw2j0la9gwfwxs";
   };
 
   checkInputs = [
diff --git a/pkgs/development/tools/electron/5.x.nix b/pkgs/development/tools/electron/5.x.nix
new file mode 100644
index 00000000000..0b993ccf2a7
--- /dev/null
+++ b/pkgs/development/tools/electron/5.x.nix
@@ -0,0 +1,86 @@
+{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }:
+
+let
+  version = "5.0.8";
+  name = "electron-${version}";
+
+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
+  meta = with stdenv.lib; {
+    description = "Cross platform desktop application shell";
+    homepage = https://github.com/electron/electron;
+    license = licenses.mit;
+    maintainers = with maintainers; [ travisbhartwell manveru ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
+  };
+
+  linux = {
+    inherit name version meta;
+    src = {
+      i686-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
+        sha256 = "1blw38x4fp4w2vs6r1d0jz3pg0m78417i0q9bvwpnwbn6wil857y";
+      };
+      x86_64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
+        sha256 = "1gz5n8gkgka7343qcwckagd4ply1lxwiaccdjv16srk2wwc9bc9m";
+      };
+      armv7l-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
+        sha256 = "1y8yna6z7xc378k6hsgngv9v98yjwq36knnr4qan0pw26paw1m82";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
+        sha256 = "1ha4ajvi0z051b6npigw6w4xi3bj3hhpxfr3xw4fgx6g6bvf1vpx";
+      };
+    }.${stdenv.hostPlatform.system} or throwSystem;
+
+    buildInputs = [ gtk3 ];
+
+    nativeBuildInputs = [
+      unzip
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
+
+    buildCommand = ''
+      mkdir -p $out/lib/electron $out/bin
+      unzip -d $out/lib/electron $src
+      ln -s $out/lib/electron/electron $out/bin
+
+      fixupPhase
+
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk at-spi2-core ]}:$out/lib/electron" \
+        $out/lib/electron/electron
+
+      wrapProgram $out/lib/electron/electron \
+        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
+        "''${gappsWrapperArgs[@]}"
+    '';
+  };
+
+  darwin = {
+    inherit name version meta;
+
+    src = fetchurl {
+      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
+      sha256 = "1h7i2ik6wms5v6ji0mp33kzfh9sd89m7w3m2nm6wrjny7m0b43ww";
+    };
+
+    buildInputs = [ unzip ];
+
+    buildCommand = ''
+      mkdir -p $out/Applications
+      unzip $src
+      mv Electron.app $out/Applications
+      mkdir -p $out/bin
+      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
+    '';
+  };
+in
+
+  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
diff --git a/pkgs/development/tools/electron/generic.nix b/pkgs/development/tools/electron/6.x.nix
similarity index 53%
rename from pkgs/development/tools/electron/generic.nix
rename to pkgs/development/tools/electron/6.x.nix
index b2ce076933d..5d412848d2d 100644
--- a/pkgs/development/tools/electron/generic.nix
+++ b/pkgs/development/tools/electron/6.x.nix
@@ -1,9 +1,11 @@
 { stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core}:
 
-version: hashes:
 let
+  version = "6.0.1";
   name = "electron-${version}";
 
+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
   meta = with stdenv.lib; {
     description = "Cross platform desktop application shell";
     homepage = https://github.com/electron/electron;
@@ -12,28 +14,27 @@ let
     platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
   };
 
-  fetcher = vers: tag: hash: fetchurl {
-    url = "https://github.com/electron/electron/releases/download/v${vers}/electron-v${vers}-${tag}.zip";
-    sha256 = hash;
-  };
-
-  tags = {
-    i686-linux = "linux-ia32";
-    x86_64-linux = "linux-x64";
-    armv7l-linux = "linux-armv7l";
-    aarch64-linux = "linux-arm64";
-    x86_64-darwin = "darwin-x64";
-  };
-
-  get = as: platform: as.${platform.system} or
-    "Unsupported system: ${platform.system}";
-
-  common = platform: {
-    inherit name version meta;
-    src = fetcher version (get tags platform) (get hashes platform);
-  };
-
   linux = {
+    inherit name version meta;
+    src = {
+      i686-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
+        sha256 = "0ly6mjcljw0axkkrz7dsvfywmjb3pmspalfk2259gyqqxj8a37pb";
+      };
+      x86_64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
+        sha256 = "0l8k6v16ynikf6x59w5byzhji0d6mqp2q0kjlrby56546qzyfkh6";
+      };
+      armv7l-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
+        sha256 = "0c2xl8dm9fmj0d92w53zbn2np2fiwr88hw0dqjdn1rwczhw7zqss";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
+        sha256 = "0iyq229snm7z411xxfsv7f0bqg6hbw2l8y6ymys110f83hp01f8a";
+      };
+    }.${stdenv.hostPlatform.system} or throwSystem;
+
     buildInputs = [ gtk3 ];
 
     nativeBuildInputs = [
@@ -63,6 +64,13 @@ let
   };
 
   darwin = {
+    inherit name version meta;
+
+    src = fetchurl {
+      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
+      sha256 = "0m8v5fs69kanrd1yk6smbmaaj9gb5j3q487z3wicifry0xn381i2";
+    };
+
     buildInputs = [ unzip ];
 
     buildCommand = ''
@@ -74,7 +82,5 @@ let
     '';
   };
 in
-  stdenv.mkDerivation (
-    (common stdenv.hostPlatform) //
-    (if stdenv.isDarwin then darwin else linux)
-  )
+
+  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index d23c5a663e6..2efd97ebb1c 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -1,46 +1,86 @@
-{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }@args:
+{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk }:
 
 let
-  mkElectron = import ./generic.nix args;
+  version = "4.2.8";
+  name = "electron-${version}";
+
+  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
+
+  meta = with stdenv.lib; {
+    description = "Cross platform desktop application shell";
+    homepage = https://github.com/electron/electron;
+    license = licenses.mit;
+    maintainers = with maintainers; [ travisbhartwell manveru ];
+    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
+  };
+
+  linux = {
+    inherit name version meta;
+    src = {
+      i686-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
+        sha256 = "1sikxr0pfpi3wrf1d7fia1vhb1gacsy9pr7qc0fycgnzsy2nvf8n";
+      };
+      x86_64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
+        sha256 = "0wc954cjc13flvdh8rkmnifdx6nirf273v1n76lsklbsq6c73i4h";
+      };
+      armv7l-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
+        sha256 = "0370ygpsm42drm70gj12i6mg960wchhqis7zz8i9is2ax1b2xjp5";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
+        sha256 = "0vl90lsjcsgcxivbaq526ffbx3lsh6axfmpkfxl8cj2jlbsg593k";
+      };
+    }.${stdenv.hostPlatform.system} or throwSystem;
+
+    buildInputs = [ gtk3 ];
+
+    nativeBuildInputs = [
+      unzip
+      makeWrapper
+      wrapGAppsHook
+    ];
+
+    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
+
+    buildCommand = ''
+      mkdir -p $out/lib/electron $out/bin
+      unzip -d $out/lib/electron $src
+      ln -s $out/lib/electron/electron $out/bin
+
+      fixupPhase
+
+      patchelf \
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk ]}:$out/lib/electron" \
+        $out/lib/electron/electron
+
+      wrapProgram $out/lib/electron/electron \
+        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
+        "''${gappsWrapperArgs[@]}"
+    '';
+  };
+
+  darwin = {
+    inherit name version meta;
+
+    src = fetchurl {
+      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
+      sha256 = "083v8k17b596fa63a7qrwyn2k8pd5vmg9yijbqbnpfcg4ja3bjx9";
+    };
+
+    buildInputs = [ unzip ];
+
+    buildCommand = ''
+      mkdir -p $out/Applications
+      unzip $src
+      mv Electron.app $out/Applications
+      mkdir -p $out/bin
+      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
+    '';
+  };
 in
-{
-  electron_4 = mkElectron "4.2.12" {
-    x86_64-linux = "72c5319c92baa7101bea3254a036c0cd3bcf257f4a03a0bb153668b7292ee2dd";
-    x86_64-darwin = "89b0e16bb9b7072ed7ed1906fccd08540acdd9f42dd8a29c97fa17d811b8c5e5";
-    i686-linux = "bf96b1736141737bb064e48bdb543302fd259de634b1790b7cf930525f47859f";
-    armv7l-linux = "2d970b3020627e5381fd4916dd8fa50ca9556202c118ab4cba09c293960689e9";
-    aarch64-linux = "938b7cc5f917247a120920df30374f86414b0c06f9f3dc7ab02be1cadc944e55";
-  };
 
-  electron_5 = mkElectron "5.0.13" {
-    x86_64-linux = "8ded43241c4b7a6f04f2ff21c75ae10e4e6db1794e8b1b4f7656c0ed21667f8f";
-    x86_64-darwin = "589834815fb9667b3c1c1aa6ccbd87d50e5660ecb430f6b475168b772b9857cd";
-    i686-linux = "ccf4a5ed226928a30bd3ea830913d99853abb089bd4a6299ffa9fa0daa8d026a";
-    armv7l-linux = "96ad83802bc61d87bb952027d49e5dd297f58e4493e66e393b26e51e09065add";
-    aarch64-linux = "01f0fd313b060fb28a1022d68fb224d415fa22986e2a8f4aded6424b65e35add";
-  };
-
-  electron_6 = mkElectron "6.1.7" {
-    x86_64-linux = "7fe94fc1edebe2f5645056a4300fc642c04155e55da8dd4ee058a0c0ef835ae8";
-    x86_64-darwin = "1c790a4cbda05f1c136d18fa6a09bdb09a1941f521207466756a3e95e343c485";
-    i686-linux = "1afd8ea79acb2b4782fb459e084549ed4cd4ead779764829b1d862148359eae5";
-    armv7l-linux = "14f2ea0459f0dda8c566b0fa4a2fe755f4220bbae313ea0c453861ac2f803196";
-    aarch64-linux = "80e05c1a0b51c335483666e959c1631a089246986b7fc3a4f9ee1288a57a602a";
-  };
-
-  electron_7 = mkElectron "7.1.10" {
-    x86_64-linux = "296f034ac9a00afa4dc99ed145410c015af3f59cd7e9becc7709d70a4f8a9ebf";
-    x86_64-darwin = "10eb453c2b19948777a6f404fbdbdd48464a4cd63db16bd3ce66b60dda016724";
-    i686-linux = "681b6440d4f0f7ffa29a34610ef41103d72937d6e524d81fd2d0fa8d9eb67936";
-    armv7l-linux = "2c09e9a77f1da152d766dc2e43719e2852b70f917229466a2ac457416d1374f7";
-    aarch64-linux = "1dad780b872bbc069eb1cac9ff4ec8f0b8d200153ab7f51397e27219094db1f0";
-  };
-
-  electron_8 = mkElectron "8.0.0" {
-    x86_64-linux = "b457a2ece83bb8a2efea42e75403740cbba051a64e325288760046b8999dd1c9";
-    x86_64-darwin = "3f96dfa1d4e0313d11b9e5c66e2df161cfdb30685ee9dadcc779bcad2fb3876e";
-    i686-linux = "0633ac2b6b6d00302e0e5df224d0e808e4ea9ecc14643e8534027e49b20436fb";
-    armv7l-linux = "8d1f3daa86c77e7aceb8c8e4491c094e789951c7d475fc536b85fe7d279794bf";
-    aarch64-linux = "484c04204478e8594d66f8bd332529c0c5eecfd71ee1705cc0478fa59c6818ee";
-  };
-}
+  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
diff --git a/pkgs/development/tools/electron/print-hashes.sh b/pkgs/development/tools/electron/print-hashes.sh
index 45656a8f7b2..203e5a4dfec 100755
--- a/pkgs/development/tools/electron/print-hashes.sh
+++ b/pkgs/development/tools/electron/print-hashes.sh
@@ -19,15 +19,11 @@ SYSTEMS=(
     [x86_64-darwin]=darwin-x64
 )
 
-hashfile="$(nix-prefetch-url --print-path "https://github.com/electron/electron/releases/download/v${VERSION}/SHASUMS256.txt" 2>/dev/null | tail -n1)"
-
-echo "Entry similar to the following goes in default.nix:"
-echo
-echo "  electron_${VERSION%%.*} = mkElectron \"${VERSION}\" {"
-
 for S in "${!SYSTEMS[@]}"; do
-  hash="$(grep " *electron-v${VERSION}-${SYSTEMS[$S]}.zip$" "$hashfile"|cut -f1 -d' ')"
-  echo "    $S = \"$hash\";"
+  HASHES["$S"]=$(nix-prefetch-url "https://github.com/electron/electron/releases/download/v${VERSION}/electron-v${VERSION}-${SYSTEMS[$S]}.zip")
 done
 
-echo "  };"
+for S in "${!HASHES[@]}"; do
+    echo "$S"
+    echo "sha256 = \"${HASHES[$S]}\";"
+done
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index ee810012862..ea3382f3e70 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -1,13 +1,12 @@
 { stdenv, lib, fetchurl, buildRubyGem, bundlerEnv, ruby, libarchive
-, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux, fetchpatch
-}:
+, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux }:
 
 let
   # NOTE: bumping the version and updating the hash is insufficient;
   # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.7";
+  version = "2.2.6";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "1z31y1nqiyj6rml9lz8gcbr29myhs5wcap8jsvgm3pb7p9p9y8m9";
+  sha256 = "0nssq2i4riif0q72h5qp7dlxd4shqcyvm1bx9adppcacb77gpnhv";
 
   deps = bundlerEnv rec {
     name = "${pname}-${version}";
@@ -54,13 +53,6 @@ in buildRubyGem rec {
     ./unofficial-installation-nowarn.patch
     ./use-system-bundler-version.patch
     ./0004-Support-system-installed-plugins.patch
-
-    # fix deprecation warning on ruby 2.6.5.
-    # See also https://github.com/hashicorp/vagrant/pull/11307
-    (fetchpatch {
-      url = "https://github.com/hashicorp/vagrant/commit/d18ed567aaa5da23c9e91ab87f360e7bf6760f13.patch";
-      sha256 = "0f61qj41rc3fdggmnha4jrqg4pzmfiriwpsz4fcgf7c0bx6qha7q";
-    })
   ];
 
   postPatch = ''
@@ -118,7 +110,7 @@ in buildRubyGem rec {
     description = "A tool for building complete development environments";
     homepage = https://www.vagrantup.com/;
     license = licenses.mit;
-    maintainers = with maintainers; [ aneeshusa ma27 ];
+    maintainers = with maintainers; [ aneeshusa ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/tools/vagrant/gemset.nix b/pkgs/development/tools/vagrant/gemset.nix
index 64f24f8270d..f9aebbe6996 100644
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@@ -14,10 +14,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
+      sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.3";
   };
   childprocess = {
     dependencies = ["ffi"];
@@ -86,10 +86,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
+      sha256 = "06mvxpjply8qh4j3fj9wh08kdzwkbnvsiysh0vrhlk5cwxzjmblh";
       type = "gem";
     };
-    version = "1.12.2";
+    version = "1.11.1";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -150,10 +150,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
+      sha256 = "1gcp1m1p6dpasycfz2sj82ci9ggz7lsskz9c9q6gvfwxrl8y9dx7";
       type = "gem";
     };
-    version = "1.8.2";
+    version = "1.1.1";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
@@ -203,10 +203,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      sha256 = "0g7l18igjb9z7q4b2ykvyxyvjxlx5pwsmx5z3ibdbr6372xgfglk";
       type = "gem";
     };
-    version = "3.3.1";
+    version = "3.3";
   };
   mime-types-data = {
     groups = ["default"];
@@ -296,10 +296,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jm76h8f8hji38z3ggf4bzi8vps6p7sagxn3ab57qc0xyga64005";
+      sha256 = "1fs7hxm9g6ywv2yih83b879klhc4fs8i0p9166z795qmd77dk0a4";
       type = "gem";
     };
-    version = "0.10.1";
+    version = "0.10.0";
   };
   rb-kqueue = {
     dependencies = ["ffi"];
@@ -348,10 +348,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qxc2zxwwipm6kviiar4gfhcakpx1jdcs89v6lvzivn5hq1xk78l";
+      sha256 = "0i5dhyiavmk2yc7xyfwzp3m476f7d9mhigibsw37jqpdq4vmi4cv";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.2.4";
   };
   unf = {
     dependencies = ["unf_ext"];
@@ -401,10 +401,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13c0vf32vinkp3ia86rvq779dacl37v4v2814v4g9qrk3liv0dym";
+      sha256 = "1sl14qdshkmficdsy9z57xmdp5z9riv7jc5lv005n0h04mg7d47b";
       type = "gem";
     };
-    version = "2.3.4";
+    version = "2.3.3";
   };
   winrm-elevated = {
     dependencies = ["erubi" "winrm" "winrm-fs"];
@@ -412,10 +412,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "12fzg9liydl244xq6r7x0wy06zn1n4czdbnjavy3150c3qsnv71a";
+      sha256 = "13d0pjzffbqicg08fsx4dsl6ibsqda5vx5d9f6hsds2z6mdilrab";
       type = "gem";
     };
-    version = "1.2.0";
+    version = "1.1.2";
   };
   winrm-fs = {
     dependencies = ["erubi" "logging" "rubyzip" "winrm"];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 4ec9cdb5547..5409947c0a1 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.213";
+  version = "4.4.212";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1cmwn9zvz14jqjy6qkszglhs2p5h6yh82b2269cbzvibg8y3rxq0";
+    sha256 = "0mx3qyj6w6h7gw7drsfsgl4iyz1695sjnf9hqh4kczci48kw5rj7";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 304f1464282..ff202b3fe9b 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.213";
+  version = "4.9.212";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0r7bqpvbpiiniwsm338b38mv6flfgm1r09avxqsakhkh8rvgz1dg";
+    sha256 = "0c5yjilaq86j6i2hzlxbp2ia7jhnf7kv952ffv7jxdf90sk3irxd";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.5.nix b/pkgs/os-specific/linux/kernel/linux-5.5.nix
index 52d1f6abca5..86654d133ab 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.5.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5.2";
+  version = "5.5.1";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "17pr9v04g3lrar585l1zpnsmrivryqxwyfvjc3qp8wrkn21z7x94";
+    sha256 = "1n9hwzbhp43a4lvmyb0mbayfnb9s1h6nbg23i93wzg7391hr28q3";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index f0c3de0229a..247fd8ed250 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "0.0.20200205";
+  version = "0.0.20200128";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "084bvjhfqxvbh5wv7a2cj8k1i1lfix2l9972xwr36hw9kvqpynnm";
+    sha256 = "05iz0pl0znx5yham8qzpym2ggc9babh36xaa504k99qqvddg8b11";
   };
 
   preConfigure = ''
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index c1c826b7812..953d8ebcbae 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchpatch
+{ stdenv, fetchurl
 # native deps.
 , runCommand, pkgconfig, meson, ninja, makeWrapper
 # build+runtime deps.
@@ -11,38 +11,31 @@ let # un-indented, over the whole file
 
 result = if extraFeatures then wrapped-full else unwrapped;
 
-inherit (stdenv.lib) optional optionals;
+inherit (stdenv.lib) optional optionals concatStringsSep;
 lua = luajitPackages;
 
+# FIXME: remove these usages once resolving
+# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
+exportLuaPathsFor = luaPkgs: ''
+  export LUA_PATH='${ concatStringsSep ";" (map lua.getLuaPath  luaPkgs)}'
+  export LUA_CPATH='${concatStringsSep ";" (map lua.getLuaCPath luaPkgs)}'
+'';
+
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "5.0.1";
+  version = "4.3.0";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "4a93264ad0cda7ea2252d1ba057e474722f77848165f2893e0c76e21ae406415";
+    sha256 = "0ca0f171ae2b2d76830967a5150eb0fa496b48b2a48f41b2be65d3743aaece25";
   };
 
   outputs = [ "out" "dev" ];
 
-  # Path fixups for the NixOS service.
-  postPatch = ''
-    patch meson.build <<EOF
-    @@ -50,2 +50,2 @@
-    -systemd_work_dir = join_paths(prefix, get_option('localstatedir'), 'lib', 'knot-resolver')
-    -systemd_cache_dir = join_paths(prefix, get_option('localstatedir'), 'cache', 'knot-resolver')
-    +systemd_work_dir  = '/var/lib/knot-resolver'
-    +systemd_cache_dir = '/var/cache/knot-resolver'
-    EOF
-
-    # ExecStart can't be overwritten in overrides.
-    # We need that to use wrapped executable and correct config file.
-    sed '/^ExecStart=/d' -i systemd/kresd@.service.in
-  '';
-
   preConfigure = ''
     patchShebangs scripts/
-  '';
+  ''
+    + stdenv.lib.optionalString doInstallCheck (exportLuaPathsFor [ lua.cqueues lua.basexx ]);
 
   nativeBuildInputs = [ pkgconfig meson ninja ];
 
@@ -60,17 +53,16 @@ unwrapped = stdenv.mkDerivation rec {
   ]
   ++ optional doInstallCheck "-Dunit_tests=enabled"
   ++ optional (doInstallCheck && !stdenv.isDarwin) "-Dconfig_tests=enabled"
-  ++ optional stdenv.isLinux "-Dsystemd_files=enabled" # used by NixOS service
     #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
   ;
 
   postInstall = ''
     rm "$out"/lib/libkres.a
-    rm "$out"/lib/knot-resolver/upgrade-4-to-5.lua # not meaningful on NixOS
   '';
 
-  doInstallCheck = with stdenv; hostPlatform == buildPlatform;
-  installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx ];
+  # aarch64: see https://github.com/wahern/cqueues/issues/223
+  doInstallCheck = with stdenv; hostPlatform == buildPlatform && !hostPlatform.isAarch64;
+  installCheckInputs = [ cmocka which cacert ];
   installCheckPhase = ''
     meson test --print-errorlogs
   '';
@@ -84,31 +76,37 @@ unwrapped = stdenv.mkDerivation rec {
   };
 };
 
-wrapped-full = runCommand unwrapped.name
+# FIXME: revert this back after resolving
+# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
+wrapped-full =
+  with stdenv.lib;
+  with luajitPackages;
+  let
+    luaPkgs = [
+      luasec luasocket # trust anchor bootstrap, prefill module
+      luafilesystem # prefill module
+      http # for http module; brings lots of deps; some are useful elsewhere
+      cqueues fifo lpeg lpeg_patterns luaossl compat53 basexx binaryheap
+    ];
+  in runCommand unwrapped.name
   {
     nativeBuildInputs = [ makeWrapper ];
-    buildInputs = with luajitPackages; [
-      # For http module, prefill module, trust anchor bootstrap.
-      # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
-      http
-      # psl isn't in nixpkgs yet, but policy.slice_randomize_psl() seems not important.
-    ];
     preferLocalBuild = true;
     allowSubstitutes = false;
   }
-  ''
-    mkdir -p "$out"/bin
+  (exportLuaPathsFor luaPkgs
+  + ''
+    mkdir -p "$out"/{bin,share}
     makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
       --set LUA_PATH  "$LUA_PATH" \
       --set LUA_CPATH "$LUA_CPATH"
 
-    ln -sr '${unwrapped}/share' "$out"/
-    ln -sr '${unwrapped}/lib'   "$out"/ # useful in NixOS service
+    ln -sr '${unwrapped}/share/man' "$out"/share/
     ln -sr "$out"/{bin,sbin}
 
     echo "Checking that 'http' module loads, i.e. lua search paths work:"
     echo "modules.load('http')" > test-http.lua
     echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-  '';
+  '');
 
 in result
diff --git a/pkgs/servers/documize-community/default.nix b/pkgs/servers/documize-community/default.nix
index 0607902295a..078936b237f 100644
--- a/pkgs/servers/documize-community/default.nix
+++ b/pkgs/servers/documize-community/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "documize-community";
-  version = "3.7.0";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "documize";
     repo = "community";
     rev = "v${version}";
-    sha256 = "1pcldf9lqvpb2h2a3kr3mahj2v1jasjwrszj6czjmkyml7x2sz7c";
+    sha256 = "0wic4j7spw9ya1m6yz0mkpqi1px6jd2vk60w8ldx0m0k606wy6ir";
   };
 
   modSha256 = "1z0v7n8klaxcqv7mvzf3jzgrp78zb4yiibx899ppk6i5qnj4xiv0";
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index 3cd8d2d4942..ada885b974c 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
   version = "2020-02-04";
   pname = "oh-my-zsh";
-  rev = "77aa1795d2f05583d4fc63a63abb0144beb5ecff";
+  rev = "6bebc254e88ac9b7fdaa7491d031f82ec107e418";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "0n36wpdlr1w4gr0cja48mcywi8av71p3diigkiv3n45a9hh94fxx";
+    sha256 = "1lmg1givymr4hgmvmngklm7q3g7dpqwm7aj5xild72cdhx0g5qqw";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/misc/lorri/default.nix b/pkgs/tools/misc/lorri/default.nix
index bbf71dec4d3..ea0bbe3dfe2 100644
--- a/pkgs/tools/misc/lorri/default.nix
+++ b/pkgs/tools/misc/lorri/default.nix
@@ -14,7 +14,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lorri";
-  version = "1.0";
+  version = "unstable-2020-01-09";
 
   meta = with stdenv.lib; {
     description = "Your project's nix-env";
@@ -27,11 +27,11 @@ rustPlatform.buildRustPackage rec {
     owner = "target";
     repo = pname;
     # Run `eval $(nix-build -A lorri.updater)` after updating the revision!
-    rev = "88c680c9abf0f04f2e294436d20073ccf26f0781";
-    sha256 = "1415mhdr0pwvshs04clfz1ys76r5qf9jz8jchm63l6llaj6m7mrv";
+    rev = "7b84837b9988d121dd72178e81afd440288106c5";
+    sha256 = "0rkga944jl6i0051vbsddfqbvzy12168cbg4ly2ng1rk0x97dbr8";
   };
 
-  cargoSha256 = "1kdpzbn3353yk7i65hll480fcy16wdvppdr6xgfh06x88xhim4mp";
+  cargoSha256 = "0k7l0zhk2vzf4nlwv4xr207irqib2dqjxfdjk1fprff84c4kblx8";
   doCheck = false;
 
   BUILD_REV_COUNT = src.revCount or 1;
diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 75fc66647e8..21403225aad 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -9,16 +9,16 @@ assert pythonSupport -> pythonPackages != null;
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia";
-  version = "0.13.0";
+  version = "0.11.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0hxdjzd2qjwf9pbnkzrnzlg0xa8vf1f65aryq7pd9895bpnk7740";
+    sha256 = "1k0pr3vn77fpfzyvbg7xb4jwm6srsiws9bsd8q7i3hl6j56a880i";
   };
 
-  cargoSha256 = "0w968ynxqkznp9g1ah040iv6ghwqwqjk1cjlr2f0j5fs57rspzf2";
+  cargoSha256 = "15bhg7b88rq8p0bn6y5wwv2l42kqb1qyx2s3kw0r0v0wadf823q3";
 
   nativeBuildInputs = [
     pkgconfig
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 842509888b4..71a71be9147 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.8.31";
+  version = "1.8.30";
 
   src = fetchurl {
     url = "ftp://ftp.sudo.ws/pub/sudo/${pname}-${version}.tar.gz";
-    sha256 = "0ks5mm9hda5idivncyfpiz4lrd8fv0dpmsl711788k7f7ixdka3y";
+    sha256 = "1rvrqlqrrjsd06dczgj9cwjdkpkqil5zzlwh87h06ms6qzfx6nm3";
   };
 
   prePatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 23a5e50f883..f90ba38fa89 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9667,8 +9667,11 @@ in
 
   aws-adfs = with python3Packages; toPythonApplication aws-adfs;
 
-  inherit (callPackages ../development/tools/electron { })
-    electron_4 electron_5 electron_6 electron_7 electron_8;
+  electron_6 = callPackage ../development/tools/electron/6.x.nix { };
+
+  electron_5 = callPackage ../development/tools/electron/5.x.nix { };
+
+  electron_4 = callPackage ../development/tools/electron { };
 
   electron_3 = callPackage ../development/tools/electron/3.x.nix { };
   electron = electron_4;

From 419bc0a4cdc0f577062f6c439809f4bf6e3b0c63 Mon Sep 17 00:00:00 2001
From: Frederik Rietdijk <fridh@fridh.nl>
Date: Wed, 5 Feb 2020 19:27:16 +0100
Subject: [PATCH 32/32] Revert "Revert "Merge master into staging-next""

In 87a19e9048773d5a363679617406ad148d36c3b8 I merged staging-next into master using the GitHub gui as intended.
In ac241fb7a570d6cf81d229ad22a8889602639160 I merged master into staging-next for the next staging cycle, however, I accidentally pushed it to master.
Thinking this may cause trouble, I reverted it in 0be87c79797a5fa384fbc356c74ed54f9f7829ea. This was however wrong, as it "removed" master.

This reverts commit 0be87c79797a5fa384fbc356c74ed54f9f7829ea.
---
 lib/strings.nix                               |   2 +-
 nixos/modules/installer/cd-dvd/iso-image.nix  |  14 +-
 nixos/modules/installer/netboot/netboot.nix   |  14 +-
 nixos/modules/misc/ids.nix                    |   4 +-
 nixos/modules/services/networking/kresd.nix   | 150 ++++++++----------
 nixos/modules/system/boot/stage-1-init.sh     |  13 +-
 nixos/tests/lorri/default.nix                 |   6 +-
 .../graphics/paraview/default.nix             |  24 ++-
 .../science/biology/spades/default.nix        |   4 +-
 pkgs/development/libraries/imlib2/default.nix |  35 ++--
 .../python-modules/dask/default.nix           |   4 +-
 pkgs/development/tools/electron/5.x.nix       |  86 ----------
 pkgs/development/tools/electron/default.nix   | 124 +++++----------
 .../tools/electron/{6.x.nix => generic.nix}   |  58 +++----
 .../tools/electron/print-hashes.sh            |  14 +-
 pkgs/development/tools/vagrant/default.nix    |  16 +-
 pkgs/development/tools/vagrant/gemset.nix     |  32 ++--
 pkgs/os-specific/linux/kernel/linux-4.4.nix   |   4 +-
 pkgs/os-specific/linux/kernel/linux-4.9.nix   |   4 +-
 pkgs/os-specific/linux/kernel/linux-5.5.nix   |   4 +-
 pkgs/os-specific/linux/wireguard/default.nix  |   4 +-
 pkgs/servers/dns/knot-resolver/default.nix    |  70 ++++----
 pkgs/servers/documize-community/default.nix   |   4 +-
 pkgs/shells/zsh/oh-my-zsh/default.nix         |   4 +-
 pkgs/tools/misc/lorri/default.nix             |   8 +-
 pkgs/tools/security/sequoia/default.nix       |   6 +-
 pkgs/tools/security/sudo/default.nix          |   4 +-
 pkgs/top-level/all-packages.nix               |   7 +-
 28 files changed, 297 insertions(+), 422 deletions(-)
 delete mode 100644 pkgs/development/tools/electron/5.x.nix
 rename pkgs/development/tools/electron/{6.x.nix => generic.nix} (53%)

diff --git a/lib/strings.nix b/lib/strings.nix
index 6dbb3d3a3e8..4f9509ffe7c 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -244,7 +244,7 @@ rec {
      Also note that Nix treats strings as a list of bytes and thus doesn't
      handle unicode.
 
-     Type: stringtoCharacters :: string -> [string]
+     Type: stringToCharacters :: string -> [string]
 
      Example:
        stringToCharacters ""
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 11319e5f4f8..4558b4dc955 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -569,14 +569,18 @@ in
       };
 
     fileSystems."/nix/store" =
-      { fsType = "unionfs-fuse";
-        device = "unionfs";
-        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
+      { fsType = "overlay";
+        device = "overlay";
+        options = [
+          "lowerdir=/nix/.ro-store"
+          "upperdir=/nix/.rw-store/store"
+          "workdir=/nix/.rw-store/work"
+        ];
       };
 
-    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" ];
+    boot.initrd.availableKernelModules = [ "squashfs" "iso9660" "uas" "overlay" ];
 
-    boot.initrd.kernelModules = [ "loop" ];
+    boot.initrd.kernelModules = [ "loop" "overlay" ];
 
     # Closures to be copied to the Nix store on the CD, namely the init
     # script and the top-level system configuration directory.
diff --git a/nixos/modules/installer/netboot/netboot.nix b/nixos/modules/installer/netboot/netboot.nix
index 5146858cccf..95eba86bcb6 100644
--- a/nixos/modules/installer/netboot/netboot.nix
+++ b/nixos/modules/installer/netboot/netboot.nix
@@ -50,14 +50,18 @@ with lib;
       };
 
     fileSystems."/nix/store" =
-      { fsType = "unionfs-fuse";
-        device = "unionfs";
-        options = [ "allow_other" "cow" "nonempty" "chroot=/mnt-root" "max_files=32768" "hide_meta_files" "dirs=/nix/.rw-store=rw:/nix/.ro-store=ro" ];
+      { fsType = "overlay";
+        device = "overlay";
+        options = [
+          "lowerdir=/nix/.ro-store"
+          "upperdir=/nix/.rw-store/store"
+          "workdir=/nix/.rw-store/work"
+        ];
       };
 
-    boot.initrd.availableKernelModules = [ "squashfs" ];
+    boot.initrd.availableKernelModules = [ "squashfs" "overlay" ];
 
-    boot.initrd.kernelModules = [ "loop" ];
+    boot.initrd.kernelModules = [ "loop" "overlay" ];
 
     # Closures to be copied to the Nix store, namely the init
     # script and the top-level system configuration directory.
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index bedd87a368e..979cdc5d4ad 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -299,7 +299,7 @@ in
       couchpotato = 267;
       gogs = 268;
       pdns-recursor = 269;
-      kresd = 270;
+      #kresd = 270; # switched to "knot-resolver" with dynamic ID
       rpc = 271;
       geoip = 272;
       fcron = 273;
@@ -600,7 +600,7 @@ in
       headphones = 266;
       couchpotato = 267;
       gogs = 268;
-      kresd = 270;
+      #kresd = 270; # switched to "knot-resolver" with dynamic ID
       #rpc = 271; # unused
       #geoip = 272; # unused
       fcron = 273;
diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index bb941e93e15..a2f91a4200b 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -3,12 +3,34 @@
 with lib;
 
 let
-
   cfg = config.services.kresd;
-  configFile = pkgs.writeText "kresd.conf" ''
-    ${optionalString (cfg.listenDoH != []) "modules.load('http')"}
-    ${cfg.extraConfig};
-  '';
+
+  # Convert systemd-style address specification to kresd config line(s).
+  # On Nix level we don't attempt to precisely validate the address specifications.
+  mkListen = kind: addr: let
+    al_v4 = builtins.match "([0-9.]\+):([0-9]\+)" addr;
+    al_v6 = builtins.match "\\[(.\+)]:([0-9]\+)" addr;
+    al_portOnly = builtins.match "()([0-9]\+)" addr;
+    al = findFirst (a: a != null)
+      (throw "services.kresd.*: incorrect address specification '${addr}'")
+      [ al_v4 al_v6 al_portOnly ];
+    port = last al;
+    addrSpec = if al_portOnly == null then "'${head al}'" else "{'::', '127.0.0.1'}";
+    in # freebind is set for compatibility with earlier kresd services;
+       # it could be configurable, for example.
+      ''
+        net.listen(${addrSpec}, ${port}, { kind = '${kind}', freebind = true })
+      '';
+
+  configFile = pkgs.writeText "kresd.conf" (
+    optionalString (cfg.listenDoH != []) ''
+      modules.load('http')
+    ''
+    + concatMapStrings (mkListen "dns") cfg.listenPlain
+    + concatMapStrings (mkListen "tls") cfg.listenTLS
+    + concatMapStrings (mkListen "doh") cfg.listenDoH
+    + cfg.extraConfig
+  );
 
   package = pkgs.knot-resolver.override {
     extraFeatures = cfg.listenDoH != [];
@@ -25,6 +47,7 @@ in {
           value
       )
     )
+    (mkRemovedOptionModule [ "services" "kresd" "cacheDir" ] "Please use (bind-)mounting instead.")
   ];
 
   ###### interface
@@ -35,8 +58,8 @@ in {
       description = ''
         Whether to enable knot-resolver domain name server.
         DNSSEC validation is turned on by default.
-        You can run <literal>sudo nc -U /run/kresd/control</literal>
-        and give commands interactively to kresd.
+        You can run <literal>sudo nc -U /run/knot-resolver/control/1</literal>
+        and give commands interactively to kresd@1.service.
       '';
     };
     extraConfig = mkOption {
@@ -46,16 +69,10 @@ in {
         Extra lines to be added verbatim to the generated configuration file.
       '';
     };
-    cacheDir = mkOption {
-      type = types.path;
-      default = "/var/cache/kresd";
-      description = ''
-        Directory for caches.  They are intended to survive reboots.
-      '';
-    };
     listenPlain = mkOption {
       type = with types; listOf str;
       default = [ "[::1]:53" "127.0.0.1:53" ];
+      example = [ "53" ];
       description = ''
         What addresses and ports the server should listen on.
         For detailed syntax see ListenStream in man systemd.socket.
@@ -75,91 +92,54 @@ in {
       default = [];
       example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
       description = ''
-        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 7858).
+        Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 8484).
         For detailed syntax see ListenStream in man systemd.socket.
       '';
     };
+    instances = mkOption {
+      type = types.ints.unsigned;
+      default = 1;
+      description = ''
+        The number of instances to start.  They will be called kresd@{1,2,...}.service.
+        Knot Resolver uses no threads, so this is the way to scale.
+        You can dynamically start/stop them at will, so this is just system default.
+      '';
+    };
     # TODO: perhaps options for more common stuff like cache size or forwarding
   };
 
   ###### implementation
   config = mkIf cfg.enable {
-    environment.etc."kresd.conf".source = configFile; # not required
+    environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
 
-    users.users.kresd =
-      { uid = config.ids.uids.kresd;
-        group = "kresd";
+    users.users.knot-resolver =
+      { isSystemUser = true;
+        group = "knot-resolver";
         description = "Knot-resolver daemon user";
       };
-    users.groups.kresd.gid = config.ids.gids.kresd;
+    users.groups.knot-resolver.gid = null;
 
-    systemd.sockets.kresd = rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      listenStreams = cfg.listenPlain;
-      socketConfig = {
-        ListenDatagram = listenStreams;
-        FreeBind = true;
-        FileDescriptorName = "dns";
-      };
+    systemd.packages = [ package ]; # the units are patched inside the package a bit
+
+    systemd.targets.kresd = { # configure units started by default
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "kres-cache-gc.service" ]
+        ++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
+    };
+    systemd.services."kresd@".serviceConfig = {
+      ExecStart = "${package}/bin/kresd --noninteractive "
+        + "-c ${package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
+      # Ensure correct ownership in case UID or GID changes.
+      CacheDirectory = "knot-resolver";
+      CacheDirectoryMode = "0750";
     };
 
-    systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      partOf = [ "kresd.socket" ];
-      listenStreams = cfg.listenTLS;
-      socketConfig = {
-        FileDescriptorName = "tls";
-        FreeBind = true;
-        Service = "kresd.service";
-      };
-    };
+    environment.etc."tmpfiles.d/knot-resolver.conf".source =
+      "${package}/lib/tmpfiles.d/knot-resolver.conf";
 
-    systemd.sockets.kresd-doh = mkIf (cfg.listenDoH != []) rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      partOf = [ "kresd.socket" ];
-      listenStreams = cfg.listenDoH;
-      socketConfig = {
-        FileDescriptorName = "doh";
-        FreeBind = true;
-        Service = "kresd.service";
-      };
-    };
-
-    systemd.sockets.kresd-control = rec {
-      wantedBy = [ "sockets.target" ];
-      before = wantedBy;
-      partOf = [ "kresd.socket" ];
-      listenStreams = [ "/run/kresd/control" ];
-      socketConfig = {
-        FileDescriptorName = "control";
-        Service = "kresd.service";
-        SocketMode = "0660"; # only root user/group may connect and control kresd
-      };
-    };
-
-    systemd.tmpfiles.rules = [ "d '${cfg.cacheDir}' 0770 kresd kresd - -" ];
-
-    systemd.services.kresd = {
-      description = "Knot-resolver daemon";
-
-      serviceConfig = {
-        User = "kresd";
-        Type = "notify";
-        WorkingDirectory = cfg.cacheDir;
-        Restart = "on-failure";
-        Sockets = [ "kresd.socket" "kresd-control.socket" ]
-          ++ optional (cfg.listenTLS != []) "kresd-tls.socket";
-      };
-
-      # Trust anchor goes from dns-root-data by default.
-      script = ''
-        exec '${package}/bin/kresd' --config '${configFile}' --forks=1
-      '';
-
-      requires = [ "kresd.socket" ];
-    };
+    # Try cleaning up the previously default location of cache file.
+    # Note that /var/cache/* should always be safe to remove.
+    # TODO: remove later, probably between 20.09 and 21.03
+    systemd.tmpfiles.rules = [ "R /var/cache/kresd" ];
   };
 }
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh
index f520bf54ad1..8736613c3d2 100644
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@@ -334,8 +334,10 @@ mountFS() {
 
     # Filter out x- options, which busybox doesn't do yet.
     local optionsFiltered="$(IFS=,; for i in $options; do if [ "${i:0:2}" != "x-" ]; then echo -n $i,; fi; done)"
+    # Prefix (lower|upper|work)dir with /mnt-root (overlayfs)
+    local optionsPrefixed="$( echo "$optionsFiltered" | sed -E 's#\<(lowerdir|upperdir|workdir)=#\1=/mnt-root#g' )"
 
-    echo "$device /mnt-root$mountPoint $fsType $optionsFiltered" >> /etc/fstab
+    echo "$device /mnt-root$mountPoint $fsType $optionsPrefixed" >> /etc/fstab
 
     checkFS "$device" "$fsType"
 
@@ -354,10 +356,11 @@ mountFS() {
             ;;
     esac
 
-    # Create backing directories for unionfs-fuse.
-    if [ "$fsType" = unionfs-fuse ]; then
-        for i in $(IFS=:; echo ${options##*,dirs=}); do
-            mkdir -m 0700 -p /mnt-root"${i%=*}"
+    # Create backing directories for overlayfs
+    if [ "$fsType" = overlay ]; then
+        for i in upper work; do
+             dir="$( echo "$optionsPrefixed" | grep -o "${i}dir=[^,]*" )"
+             mkdir -m 0700 -p "${dir##*=}"
         done
     fi
 
diff --git a/nixos/tests/lorri/default.nix b/nixos/tests/lorri/default.nix
index 53074385a65..198171082d8 100644
--- a/nixos/tests/lorri/default.nix
+++ b/nixos/tests/lorri/default.nix
@@ -15,12 +15,12 @@ import ../make-test-python.nix {
 
     # Start the daemon and wait until it is ready
     machine.execute("lorri daemon > lorri.stdout 2> lorri.stderr &")
-    machine.wait_until_succeeds("grep --fixed-strings 'lorri: ready' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'ready' lorri.stdout")
 
     # Ping the daemon
-    machine.execute("lorri ping_ $(readlink -f shell.nix)")
+    machine.succeed("lorri internal__ping shell.nix")
 
     # Wait for the daemon to finish the build
-    machine.wait_until_succeeds("grep --fixed-strings 'OutputPaths' lorri.stdout")
+    machine.wait_until_succeeds("grep --fixed-strings 'Completed' lorri.stdout")
   '';
 }
diff --git a/pkgs/applications/graphics/paraview/default.nix b/pkgs/applications/graphics/paraview/default.nix
index d0351e98ee0..ac01c28ebd4 100644
--- a/pkgs/applications/graphics/paraview/default.nix
+++ b/pkgs/applications/graphics/paraview/default.nix
@@ -1,9 +1,5 @@
-{
-stdenv, fetchFromGitHub, cmake, makeWrapper
-,qtbase, qttools, python, libGLU, libGL
-,libXt, qtx11extras, qtxmlpatterns
-, mkDerivation
-}:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, qtbase , qttools, python
+, libGLU, libGL , libXt, qtx11extras, qtxmlpatterns , mkDerivation }:
 
 mkDerivation rec {
   pname = "paraview";
@@ -53,20 +49,20 @@ mkDerivation rec {
 
   # Paraview links into the Python library, resolving symbolic links on the way,
   # so we need to put the correct sitePackages (with numpy) back on the path
-  postInstall = ''
-    wrapProgram $out/bin/paraview \
+  preFixup = ''
+    wrapQtApp $out/bin/paraview \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapProgram $out/bin/pvbatch \
+    wrapQtApp $out/bin/pvbatch \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
-    wrapProgram $out/bin/pvpython \
+    wrapQtApp $out/bin/pvpython \
       --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.paraview.org/;
     description = "3D Data analysis and visualization application";
-    license = stdenv.lib.licenses.free;
-    maintainers = with stdenv.lib.maintainers; [guibert];
-    platforms = with stdenv.lib.platforms; linux;
+    license = licenses.free;
+    maintainers = with maintainers; [ guibert ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/applications/science/biology/spades/default.nix b/pkgs/applications/science/biology/spades/default.nix
index a195f79010a..08a6a0d2509 100644
--- a/pkgs/applications/science/biology/spades/default.nix
+++ b/pkgs/applications/science/biology/spades/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "SPAdes";
-  version = "3.13.1";
+  version = "3.14.0";
 
   src = fetchurl {
     url = "http://cab.spbu.ru/files/release${version}/${pname}-${version}.tar.gz";
-    sha256 = "0giayz197lmq2108filkn9izma3i803sb3iskv9hs5snzdr9p8ld";
+    sha256 = "1ffxswd2ngkpy1d6l3lb6a9cmyy1fglbdsws00b3m1k22zaqv60q";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/imlib2/default.nix b/pkgs/development/libraries/imlib2/default.nix
index 2576580908a..36b1063531e 100644
--- a/pkgs/development/libraries/imlib2/default.nix
+++ b/pkgs/development/libraries/imlib2/default.nix
@@ -1,19 +1,28 @@
-{ stdenv, fetchurl, libjpeg, libtiff, giflib, libpng, bzip2, pkgconfig
-, freetype, libid3tag
-, x11Support ? true, xlibsWrapper ? null }:
-
-with stdenv.lib;
+{ stdenv, fetchurl
+# Image file formats
+, libjpeg, libtiff, giflib, libpng, libwebp
+# imlib2 can load images from ID3 tags.
+, libid3tag
+, freetype , bzip2, pkgconfig
+, x11Support ? true, xlibsWrapper ? null
+}:
 
+let
+  inherit (stdenv.lib) optional;
+in
 stdenv.mkDerivation rec {
-  name = "imlib2-1.5.1";
+  pname = "imlib2";
+  version = "1.6.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/enlightenment/${name}.tar.bz2";
-    sha256 = "1bms2iwmvnvpz5jqq3r52glarqkafif47zbh1ykz8hw85d2mfkps";
+    url = "mirror://sourceforge/enlightenment/${pname}-${version}.tar.bz2";
+    sha256 = "0v8n3dswx7rxqfd0q03xwc7j2w1mv8lv18rdxv487a1xw5vklfad";
   };
 
-  buildInputs = [ libjpeg libtiff giflib libpng bzip2 freetype libid3tag ]
-    ++ optional x11Support xlibsWrapper;
+  buildInputs = [
+    libjpeg libtiff giflib libpng libwebp
+    bzip2 freetype libid3tag
+  ] ++ optional x11Support xlibsWrapper;
 
   nativeBuildInputs = [ pkgconfig ];
 
@@ -35,7 +44,7 @@ stdenv.mkDerivation rec {
     moveToOutput bin/imlib2-config "$dev"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Image manipulation library";
 
     longDescription = ''
@@ -46,8 +55,8 @@ stdenv.mkDerivation rec {
       easily, without sacrificing speed.
     '';
 
-    homepage = http://docs.enlightenment.org/api/imlib2/html;
-    license = licenses.free;
+    homepage = "https://docs.enlightenment.org/api/imlib2/html";
+    license = licenses.mit;
     platforms = platforms.unix;
     maintainers = with maintainers; [ spwhitt ];
   };
diff --git a/pkgs/development/python-modules/dask/default.nix b/pkgs/development/python-modules/dask/default.nix
index beef26ec5be..ef47f419a6e 100644
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "dask";
-  version = "2.9.1";
+  version = "2.10.1";
 
   disabled = pythonOlder "3.5";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "dask";
     repo = pname;
     rev = version;
-    sha256 = "1xayr4gkp4slvmh2ksdr0d196giz3yhknqjjg1vw2j0la9gwfwxs";
+    sha256 = "035mr7385yf5ng5wf60qxr80529h8dsla5hymkyg68dxhkd0jvbr";
   };
 
   checkInputs = [
diff --git a/pkgs/development/tools/electron/5.x.nix b/pkgs/development/tools/electron/5.x.nix
deleted file mode 100644
index 0b993ccf2a7..00000000000
--- a/pkgs/development/tools/electron/5.x.nix
+++ /dev/null
@@ -1,86 +0,0 @@
-{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }:
-
-let
-  version = "5.0.8";
-  name = "electron-${version}";
-
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-
-  meta = with stdenv.lib; {
-    description = "Cross platform desktop application shell";
-    homepage = https://github.com/electron/electron;
-    license = licenses.mit;
-    maintainers = with maintainers; [ travisbhartwell manveru ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
-  };
-
-  linux = {
-    inherit name version meta;
-    src = {
-      i686-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
-        sha256 = "1blw38x4fp4w2vs6r1d0jz3pg0m78417i0q9bvwpnwbn6wil857y";
-      };
-      x86_64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
-        sha256 = "1gz5n8gkgka7343qcwckagd4ply1lxwiaccdjv16srk2wwc9bc9m";
-      };
-      armv7l-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
-        sha256 = "1y8yna6z7xc378k6hsgngv9v98yjwq36knnr4qan0pw26paw1m82";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
-        sha256 = "1ha4ajvi0z051b6npigw6w4xi3bj3hhpxfr3xw4fgx6g6bvf1vpx";
-      };
-    }.${stdenv.hostPlatform.system} or throwSystem;
-
-    buildInputs = [ gtk3 ];
-
-    nativeBuildInputs = [
-      unzip
-      makeWrapper
-      wrapGAppsHook
-    ];
-
-    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
-
-    buildCommand = ''
-      mkdir -p $out/lib/electron $out/bin
-      unzip -d $out/lib/electron $src
-      ln -s $out/lib/electron/electron $out/bin
-
-      fixupPhase
-
-      patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk at-spi2-core ]}:$out/lib/electron" \
-        $out/lib/electron/electron
-
-      wrapProgram $out/lib/electron/electron \
-        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
-        "''${gappsWrapperArgs[@]}"
-    '';
-  };
-
-  darwin = {
-    inherit name version meta;
-
-    src = fetchurl {
-      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
-      sha256 = "1h7i2ik6wms5v6ji0mp33kzfh9sd89m7w3m2nm6wrjny7m0b43ww";
-    };
-
-    buildInputs = [ unzip ];
-
-    buildCommand = ''
-      mkdir -p $out/Applications
-      unzip $src
-      mv Electron.app $out/Applications
-      mkdir -p $out/bin
-      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
-    '';
-  };
-in
-
-  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
diff --git a/pkgs/development/tools/electron/default.nix b/pkgs/development/tools/electron/default.nix
index 2efd97ebb1c..d23c5a663e6 100644
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@@ -1,86 +1,46 @@
-{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk }:
+{ stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core }@args:
 
 let
-  version = "4.2.8";
-  name = "electron-${version}";
-
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-
-  meta = with stdenv.lib; {
-    description = "Cross platform desktop application shell";
-    homepage = https://github.com/electron/electron;
-    license = licenses.mit;
-    maintainers = with maintainers; [ travisbhartwell manveru ];
-    platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
-  };
-
-  linux = {
-    inherit name version meta;
-    src = {
-      i686-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
-        sha256 = "1sikxr0pfpi3wrf1d7fia1vhb1gacsy9pr7qc0fycgnzsy2nvf8n";
-      };
-      x86_64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
-        sha256 = "0wc954cjc13flvdh8rkmnifdx6nirf273v1n76lsklbsq6c73i4h";
-      };
-      armv7l-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
-        sha256 = "0370ygpsm42drm70gj12i6mg960wchhqis7zz8i9is2ax1b2xjp5";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
-        sha256 = "0vl90lsjcsgcxivbaq526ffbx3lsh6axfmpkfxl8cj2jlbsg593k";
-      };
-    }.${stdenv.hostPlatform.system} or throwSystem;
-
-    buildInputs = [ gtk3 ];
-
-    nativeBuildInputs = [
-      unzip
-      makeWrapper
-      wrapGAppsHook
-    ];
-
-    dontWrapGApps = true; # electron is in lib, we need to wrap it manually
-
-    buildCommand = ''
-      mkdir -p $out/lib/electron $out/bin
-      unzip -d $out/lib/electron $src
-      ln -s $out/lib/electron/electron $out/bin
-
-      fixupPhase
-
-      patchelf \
-        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${atomEnv.libPath}:${stdenv.lib.makeLibraryPath [ libuuid at-spi2-atk ]}:$out/lib/electron" \
-        $out/lib/electron/electron
-
-      wrapProgram $out/lib/electron/electron \
-        --prefix LD_PRELOAD : ${stdenv.lib.makeLibraryPath [ libXScrnSaver ]}/libXss.so.1 \
-        "''${gappsWrapperArgs[@]}"
-    '';
-  };
-
-  darwin = {
-    inherit name version meta;
-
-    src = fetchurl {
-      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
-      sha256 = "083v8k17b596fa63a7qrwyn2k8pd5vmg9yijbqbnpfcg4ja3bjx9";
-    };
-
-    buildInputs = [ unzip ];
-
-    buildCommand = ''
-      mkdir -p $out/Applications
-      unzip $src
-      mv Electron.app $out/Applications
-      mkdir -p $out/bin
-      ln -s $out/Applications/Electron.app/Contents/MacOs/Electron $out/bin/electron
-    '';
-  };
+  mkElectron = import ./generic.nix args;
 in
+{
+  electron_4 = mkElectron "4.2.12" {
+    x86_64-linux = "72c5319c92baa7101bea3254a036c0cd3bcf257f4a03a0bb153668b7292ee2dd";
+    x86_64-darwin = "89b0e16bb9b7072ed7ed1906fccd08540acdd9f42dd8a29c97fa17d811b8c5e5";
+    i686-linux = "bf96b1736141737bb064e48bdb543302fd259de634b1790b7cf930525f47859f";
+    armv7l-linux = "2d970b3020627e5381fd4916dd8fa50ca9556202c118ab4cba09c293960689e9";
+    aarch64-linux = "938b7cc5f917247a120920df30374f86414b0c06f9f3dc7ab02be1cadc944e55";
+  };
 
-  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
+  electron_5 = mkElectron "5.0.13" {
+    x86_64-linux = "8ded43241c4b7a6f04f2ff21c75ae10e4e6db1794e8b1b4f7656c0ed21667f8f";
+    x86_64-darwin = "589834815fb9667b3c1c1aa6ccbd87d50e5660ecb430f6b475168b772b9857cd";
+    i686-linux = "ccf4a5ed226928a30bd3ea830913d99853abb089bd4a6299ffa9fa0daa8d026a";
+    armv7l-linux = "96ad83802bc61d87bb952027d49e5dd297f58e4493e66e393b26e51e09065add";
+    aarch64-linux = "01f0fd313b060fb28a1022d68fb224d415fa22986e2a8f4aded6424b65e35add";
+  };
+
+  electron_6 = mkElectron "6.1.7" {
+    x86_64-linux = "7fe94fc1edebe2f5645056a4300fc642c04155e55da8dd4ee058a0c0ef835ae8";
+    x86_64-darwin = "1c790a4cbda05f1c136d18fa6a09bdb09a1941f521207466756a3e95e343c485";
+    i686-linux = "1afd8ea79acb2b4782fb459e084549ed4cd4ead779764829b1d862148359eae5";
+    armv7l-linux = "14f2ea0459f0dda8c566b0fa4a2fe755f4220bbae313ea0c453861ac2f803196";
+    aarch64-linux = "80e05c1a0b51c335483666e959c1631a089246986b7fc3a4f9ee1288a57a602a";
+  };
+
+  electron_7 = mkElectron "7.1.10" {
+    x86_64-linux = "296f034ac9a00afa4dc99ed145410c015af3f59cd7e9becc7709d70a4f8a9ebf";
+    x86_64-darwin = "10eb453c2b19948777a6f404fbdbdd48464a4cd63db16bd3ce66b60dda016724";
+    i686-linux = "681b6440d4f0f7ffa29a34610ef41103d72937d6e524d81fd2d0fa8d9eb67936";
+    armv7l-linux = "2c09e9a77f1da152d766dc2e43719e2852b70f917229466a2ac457416d1374f7";
+    aarch64-linux = "1dad780b872bbc069eb1cac9ff4ec8f0b8d200153ab7f51397e27219094db1f0";
+  };
+
+  electron_8 = mkElectron "8.0.0" {
+    x86_64-linux = "b457a2ece83bb8a2efea42e75403740cbba051a64e325288760046b8999dd1c9";
+    x86_64-darwin = "3f96dfa1d4e0313d11b9e5c66e2df161cfdb30685ee9dadcc779bcad2fb3876e";
+    i686-linux = "0633ac2b6b6d00302e0e5df224d0e808e4ea9ecc14643e8534027e49b20436fb";
+    armv7l-linux = "8d1f3daa86c77e7aceb8c8e4491c094e789951c7d475fc536b85fe7d279794bf";
+    aarch64-linux = "484c04204478e8594d66f8bd332529c0c5eecfd71ee1705cc0478fa59c6818ee";
+  };
+}
diff --git a/pkgs/development/tools/electron/6.x.nix b/pkgs/development/tools/electron/generic.nix
similarity index 53%
rename from pkgs/development/tools/electron/6.x.nix
rename to pkgs/development/tools/electron/generic.nix
index 5d412848d2d..b2ce076933d 100644
--- a/pkgs/development/tools/electron/6.x.nix
+++ b/pkgs/development/tools/electron/generic.nix
@@ -1,11 +1,9 @@
 { stdenv, libXScrnSaver, makeWrapper, fetchurl, wrapGAppsHook, gtk3, unzip, atomEnv, libuuid, at-spi2-atk, at-spi2-core}:
 
+version: hashes:
 let
-  version = "6.0.1";
   name = "electron-${version}";
 
-  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
-
   meta = with stdenv.lib; {
     description = "Cross platform desktop application shell";
     homepage = https://github.com/electron/electron;
@@ -14,27 +12,28 @@ let
     platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" "armv7l-linux" "aarch64-linux" ];
   };
 
-  linux = {
-    inherit name version meta;
-    src = {
-      i686-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-ia32.zip";
-        sha256 = "0ly6mjcljw0axkkrz7dsvfywmjb3pmspalfk2259gyqqxj8a37pb";
-      };
-      x86_64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-x64.zip";
-        sha256 = "0l8k6v16ynikf6x59w5byzhji0d6mqp2q0kjlrby56546qzyfkh6";
-      };
-      armv7l-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-armv7l.zip";
-        sha256 = "0c2xl8dm9fmj0d92w53zbn2np2fiwr88hw0dqjdn1rwczhw7zqss";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-linux-arm64.zip";
-        sha256 = "0iyq229snm7z411xxfsv7f0bqg6hbw2l8y6ymys110f83hp01f8a";
-      };
-    }.${stdenv.hostPlatform.system} or throwSystem;
+  fetcher = vers: tag: hash: fetchurl {
+    url = "https://github.com/electron/electron/releases/download/v${vers}/electron-v${vers}-${tag}.zip";
+    sha256 = hash;
+  };
 
+  tags = {
+    i686-linux = "linux-ia32";
+    x86_64-linux = "linux-x64";
+    armv7l-linux = "linux-armv7l";
+    aarch64-linux = "linux-arm64";
+    x86_64-darwin = "darwin-x64";
+  };
+
+  get = as: platform: as.${platform.system} or
+    "Unsupported system: ${platform.system}";
+
+  common = platform: {
+    inherit name version meta;
+    src = fetcher version (get tags platform) (get hashes platform);
+  };
+
+  linux = {
     buildInputs = [ gtk3 ];
 
     nativeBuildInputs = [
@@ -64,13 +63,6 @@ let
   };
 
   darwin = {
-    inherit name version meta;
-
-    src = fetchurl {
-      url = "https://github.com/electron/electron/releases/download/v${version}/electron-v${version}-darwin-x64.zip";
-      sha256 = "0m8v5fs69kanrd1yk6smbmaaj9gb5j3q487z3wicifry0xn381i2";
-    };
-
     buildInputs = [ unzip ];
 
     buildCommand = ''
@@ -82,5 +74,7 @@ let
     '';
   };
 in
-
-  stdenv.mkDerivation (if stdenv.isDarwin then darwin else linux)
+  stdenv.mkDerivation (
+    (common stdenv.hostPlatform) //
+    (if stdenv.isDarwin then darwin else linux)
+  )
diff --git a/pkgs/development/tools/electron/print-hashes.sh b/pkgs/development/tools/electron/print-hashes.sh
index 203e5a4dfec..45656a8f7b2 100755
--- a/pkgs/development/tools/electron/print-hashes.sh
+++ b/pkgs/development/tools/electron/print-hashes.sh
@@ -19,11 +19,15 @@ SYSTEMS=(
     [x86_64-darwin]=darwin-x64
 )
 
+hashfile="$(nix-prefetch-url --print-path "https://github.com/electron/electron/releases/download/v${VERSION}/SHASUMS256.txt" 2>/dev/null | tail -n1)"
+
+echo "Entry similar to the following goes in default.nix:"
+echo
+echo "  electron_${VERSION%%.*} = mkElectron \"${VERSION}\" {"
+
 for S in "${!SYSTEMS[@]}"; do
-  HASHES["$S"]=$(nix-prefetch-url "https://github.com/electron/electron/releases/download/v${VERSION}/electron-v${VERSION}-${SYSTEMS[$S]}.zip")
+  hash="$(grep " *electron-v${VERSION}-${SYSTEMS[$S]}.zip$" "$hashfile"|cut -f1 -d' ')"
+  echo "    $S = \"$hash\";"
 done
 
-for S in "${!HASHES[@]}"; do
-    echo "$S"
-    echo "sha256 = \"${HASHES[$S]}\";"
-done
+echo "  };"
diff --git a/pkgs/development/tools/vagrant/default.nix b/pkgs/development/tools/vagrant/default.nix
index ea3382f3e70..ee810012862 100644
--- a/pkgs/development/tools/vagrant/default.nix
+++ b/pkgs/development/tools/vagrant/default.nix
@@ -1,12 +1,13 @@
 { stdenv, lib, fetchurl, buildRubyGem, bundlerEnv, ruby, libarchive
-, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux }:
+, libguestfs, qemu, writeText, withLibvirt ? stdenv.isLinux, fetchpatch
+}:
 
 let
   # NOTE: bumping the version and updating the hash is insufficient;
   # you must use bundix to generate a new gemset.nix in the Vagrant source.
-  version = "2.2.6";
+  version = "2.2.7";
   url = "https://github.com/hashicorp/vagrant/archive/v${version}.tar.gz";
-  sha256 = "0nssq2i4riif0q72h5qp7dlxd4shqcyvm1bx9adppcacb77gpnhv";
+  sha256 = "1z31y1nqiyj6rml9lz8gcbr29myhs5wcap8jsvgm3pb7p9p9y8m9";
 
   deps = bundlerEnv rec {
     name = "${pname}-${version}";
@@ -53,6 +54,13 @@ in buildRubyGem rec {
     ./unofficial-installation-nowarn.patch
     ./use-system-bundler-version.patch
     ./0004-Support-system-installed-plugins.patch
+
+    # fix deprecation warning on ruby 2.6.5.
+    # See also https://github.com/hashicorp/vagrant/pull/11307
+    (fetchpatch {
+      url = "https://github.com/hashicorp/vagrant/commit/d18ed567aaa5da23c9e91ab87f360e7bf6760f13.patch";
+      sha256 = "0f61qj41rc3fdggmnha4jrqg4pzmfiriwpsz4fcgf7c0bx6qha7q";
+    })
   ];
 
   postPatch = ''
@@ -110,7 +118,7 @@ in buildRubyGem rec {
     description = "A tool for building complete development environments";
     homepage = https://www.vagrantup.com/;
     license = licenses.mit;
-    maintainers = with maintainers; [ aneeshusa ];
+    maintainers = with maintainers; [ aneeshusa ma27 ];
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/development/tools/vagrant/gemset.nix b/pkgs/development/tools/vagrant/gemset.nix
index f9aebbe6996..64f24f8270d 100644
--- a/pkgs/development/tools/vagrant/gemset.nix
+++ b/pkgs/development/tools/vagrant/gemset.nix
@@ -14,10 +14,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
+      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
       type = "gem";
     };
-    version = "3.2.3";
+    version = "3.2.4";
   };
   childprocess = {
     dependencies = ["ffi"];
@@ -86,10 +86,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06mvxpjply8qh4j3fj9wh08kdzwkbnvsiysh0vrhlk5cwxzjmblh";
+      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
       type = "gem";
     };
-    version = "1.11.1";
+    version = "1.12.2";
   };
   gssapi = {
     dependencies = ["ffi"];
@@ -150,10 +150,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gcp1m1p6dpasycfz2sj82ci9ggz7lsskz9c9q6gvfwxrl8y9dx7";
+      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "1.8.2";
   };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
@@ -203,10 +203,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g7l18igjb9z7q4b2ykvyxyvjxlx5pwsmx5z3ibdbr6372xgfglk";
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
       type = "gem";
     };
-    version = "3.3";
+    version = "3.3.1";
   };
   mime-types-data = {
     groups = ["default"];
@@ -296,10 +296,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fs7hxm9g6ywv2yih83b879klhc4fs8i0p9166z795qmd77dk0a4";
+      sha256 = "1jm76h8f8hji38z3ggf4bzi8vps6p7sagxn3ab57qc0xyga64005";
       type = "gem";
     };
-    version = "0.10.0";
+    version = "0.10.1";
   };
   rb-kqueue = {
     dependencies = ["ffi"];
@@ -348,10 +348,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0i5dhyiavmk2yc7xyfwzp3m476f7d9mhigibsw37jqpdq4vmi4cv";
+      sha256 = "1qxc2zxwwipm6kviiar4gfhcakpx1jdcs89v6lvzivn5hq1xk78l";
       type = "gem";
     };
-    version = "1.2.4";
+    version = "1.3.0";
   };
   unf = {
     dependencies = ["unf_ext"];
@@ -401,10 +401,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1sl14qdshkmficdsy9z57xmdp5z9riv7jc5lv005n0h04mg7d47b";
+      sha256 = "13c0vf32vinkp3ia86rvq779dacl37v4v2814v4g9qrk3liv0dym";
       type = "gem";
     };
-    version = "2.3.3";
+    version = "2.3.4";
   };
   winrm-elevated = {
     dependencies = ["erubi" "winrm" "winrm-fs"];
@@ -412,10 +412,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13d0pjzffbqicg08fsx4dsl6ibsqda5vx5d9f6hsds2z6mdilrab";
+      sha256 = "12fzg9liydl244xq6r7x0wy06zn1n4czdbnjavy3150c3qsnv71a";
       type = "gem";
     };
-    version = "1.1.2";
+    version = "1.2.0";
   };
   winrm-fs = {
     dependencies = ["erubi" "logging" "rubyzip" "winrm"];
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 5409947c0a1..4ec9cdb5547 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.212";
+  version = "4.4.213";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0mx3qyj6w6h7gw7drsfsgl4iyz1695sjnf9hqh4kczci48kw5rj7";
+    sha256 = "1cmwn9zvz14jqjy6qkszglhs2p5h6yh82b2269cbzvibg8y3rxq0";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index ff202b3fe9b..304f1464282 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.212";
+  version = "4.9.213";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0c5yjilaq86j6i2hzlxbp2ia7jhnf7kv952ffv7jxdf90sk3irxd";
+    sha256 = "0r7bqpvbpiiniwsm338b38mv6flfgm1r09avxqsakhkh8rvgz1dg";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.5.nix b/pkgs/os-specific/linux/kernel/linux-5.5.nix
index 86654d133ab..52d1f6abca5 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.5.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.5.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.5.1";
+  version = "5.5.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1n9hwzbhp43a4lvmyb0mbayfnb9s1h6nbg23i93wzg7391hr28q3";
+    sha256 = "17pr9v04g3lrar585l1zpnsmrivryqxwyfvjc3qp8wrkn21z7x94";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 247fd8ed250..f0c3de0229a 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -7,11 +7,11 @@ assert stdenv.lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "0.0.20200128";
+  version = "0.0.20200205";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "05iz0pl0znx5yham8qzpym2ggc9babh36xaa504k99qqvddg8b11";
+    sha256 = "084bvjhfqxvbh5wv7a2cj8k1i1lfix2l9972xwr36hw9kvqpynnm";
   };
 
   preConfigure = ''
diff --git a/pkgs/servers/dns/knot-resolver/default.nix b/pkgs/servers/dns/knot-resolver/default.nix
index 953d8ebcbae..c1c826b7812 100644
--- a/pkgs/servers/dns/knot-resolver/default.nix
+++ b/pkgs/servers/dns/knot-resolver/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, fetchpatch
 # native deps.
 , runCommand, pkgconfig, meson, ninja, makeWrapper
 # build+runtime deps.
@@ -11,31 +11,38 @@ let # un-indented, over the whole file
 
 result = if extraFeatures then wrapped-full else unwrapped;
 
-inherit (stdenv.lib) optional optionals concatStringsSep;
+inherit (stdenv.lib) optional optionals;
 lua = luajitPackages;
 
-# FIXME: remove these usages once resolving
-# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
-exportLuaPathsFor = luaPkgs: ''
-  export LUA_PATH='${ concatStringsSep ";" (map lua.getLuaPath  luaPkgs)}'
-  export LUA_CPATH='${concatStringsSep ";" (map lua.getLuaCPath luaPkgs)}'
-'';
-
 unwrapped = stdenv.mkDerivation rec {
   pname = "knot-resolver";
-  version = "4.3.0";
+  version = "5.0.1";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "0ca0f171ae2b2d76830967a5150eb0fa496b48b2a48f41b2be65d3743aaece25";
+    sha256 = "4a93264ad0cda7ea2252d1ba057e474722f77848165f2893e0c76e21ae406415";
   };
 
   outputs = [ "out" "dev" ];
 
+  # Path fixups for the NixOS service.
+  postPatch = ''
+    patch meson.build <<EOF
+    @@ -50,2 +50,2 @@
+    -systemd_work_dir = join_paths(prefix, get_option('localstatedir'), 'lib', 'knot-resolver')
+    -systemd_cache_dir = join_paths(prefix, get_option('localstatedir'), 'cache', 'knot-resolver')
+    +systemd_work_dir  = '/var/lib/knot-resolver'
+    +systemd_cache_dir = '/var/cache/knot-resolver'
+    EOF
+
+    # ExecStart can't be overwritten in overrides.
+    # We need that to use wrapped executable and correct config file.
+    sed '/^ExecStart=/d' -i systemd/kresd@.service.in
+  '';
+
   preConfigure = ''
     patchShebangs scripts/
-  ''
-    + stdenv.lib.optionalString doInstallCheck (exportLuaPathsFor [ lua.cqueues lua.basexx ]);
+  '';
 
   nativeBuildInputs = [ pkgconfig meson ninja ];
 
@@ -53,16 +60,17 @@ unwrapped = stdenv.mkDerivation rec {
   ]
   ++ optional doInstallCheck "-Dunit_tests=enabled"
   ++ optional (doInstallCheck && !stdenv.isDarwin) "-Dconfig_tests=enabled"
+  ++ optional stdenv.isLinux "-Dsystemd_files=enabled" # used by NixOS service
     #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too.
   ;
 
   postInstall = ''
     rm "$out"/lib/libkres.a
+    rm "$out"/lib/knot-resolver/upgrade-4-to-5.lua # not meaningful on NixOS
   '';
 
-  # aarch64: see https://github.com/wahern/cqueues/issues/223
-  doInstallCheck = with stdenv; hostPlatform == buildPlatform && !hostPlatform.isAarch64;
-  installCheckInputs = [ cmocka which cacert ];
+  doInstallCheck = with stdenv; hostPlatform == buildPlatform;
+  installCheckInputs = [ cmocka which cacert lua.cqueues lua.basexx ];
   installCheckPhase = ''
     meson test --print-errorlogs
   '';
@@ -76,37 +84,31 @@ unwrapped = stdenv.mkDerivation rec {
   };
 };
 
-# FIXME: revert this back after resolving
-# https://github.com/NixOS/nixpkgs/pull/63108#issuecomment-508670438
-wrapped-full =
-  with stdenv.lib;
-  with luajitPackages;
-  let
-    luaPkgs = [
-      luasec luasocket # trust anchor bootstrap, prefill module
-      luafilesystem # prefill module
-      http # for http module; brings lots of deps; some are useful elsewhere
-      cqueues fifo lpeg lpeg_patterns luaossl compat53 basexx binaryheap
-    ];
-  in runCommand unwrapped.name
+wrapped-full = runCommand unwrapped.name
   {
     nativeBuildInputs = [ makeWrapper ];
+    buildInputs = with luajitPackages; [
+      # For http module, prefill module, trust anchor bootstrap.
+      # It brings lots of deps; some are useful elsewhere (e.g. cqueues).
+      http
+      # psl isn't in nixpkgs yet, but policy.slice_randomize_psl() seems not important.
+    ];
     preferLocalBuild = true;
     allowSubstitutes = false;
   }
-  (exportLuaPathsFor luaPkgs
-  + ''
-    mkdir -p "$out"/{bin,share}
+  ''
+    mkdir -p "$out"/bin
     makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \
       --set LUA_PATH  "$LUA_PATH" \
       --set LUA_CPATH "$LUA_CPATH"
 
-    ln -sr '${unwrapped}/share/man' "$out"/share/
+    ln -sr '${unwrapped}/share' "$out"/
+    ln -sr '${unwrapped}/lib'   "$out"/ # useful in NixOS service
     ln -sr "$out"/{bin,sbin}
 
     echo "Checking that 'http' module loads, i.e. lua search paths work:"
     echo "modules.load('http')" > test-http.lua
     echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua
-  '');
+  '';
 
 in result
diff --git a/pkgs/servers/documize-community/default.nix b/pkgs/servers/documize-community/default.nix
index 078936b237f..0607902295a 100644
--- a/pkgs/servers/documize-community/default.nix
+++ b/pkgs/servers/documize-community/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "documize-community";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "documize";
     repo = "community";
     rev = "v${version}";
-    sha256 = "0wic4j7spw9ya1m6yz0mkpqi1px6jd2vk60w8ldx0m0k606wy6ir";
+    sha256 = "1pcldf9lqvpb2h2a3kr3mahj2v1jasjwrszj6czjmkyml7x2sz7c";
   };
 
   modSha256 = "1z0v7n8klaxcqv7mvzf3jzgrp78zb4yiibx899ppk6i5qnj4xiv0";
diff --git a/pkgs/shells/zsh/oh-my-zsh/default.nix b/pkgs/shells/zsh/oh-my-zsh/default.nix
index ada885b974c..3cd8d2d4942 100644
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@@ -6,11 +6,11 @@
 stdenv.mkDerivation rec {
   version = "2020-02-04";
   pname = "oh-my-zsh";
-  rev = "6bebc254e88ac9b7fdaa7491d031f82ec107e418";
+  rev = "77aa1795d2f05583d4fc63a63abb0144beb5ecff";
 
   src = fetchgit { inherit rev;
     url = "https://github.com/ohmyzsh/ohmyzsh";
-    sha256 = "1lmg1givymr4hgmvmngklm7q3g7dpqwm7aj5xild72cdhx0g5qqw";
+    sha256 = "0n36wpdlr1w4gr0cja48mcywi8av71p3diigkiv3n45a9hh94fxx";
   };
 
   pathsToLink = [ "/share/oh-my-zsh" ];
diff --git a/pkgs/tools/misc/lorri/default.nix b/pkgs/tools/misc/lorri/default.nix
index ea0bbe3dfe2..bbf71dec4d3 100644
--- a/pkgs/tools/misc/lorri/default.nix
+++ b/pkgs/tools/misc/lorri/default.nix
@@ -14,7 +14,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lorri";
-  version = "unstable-2020-01-09";
+  version = "1.0";
 
   meta = with stdenv.lib; {
     description = "Your project's nix-env";
@@ -27,11 +27,11 @@ rustPlatform.buildRustPackage rec {
     owner = "target";
     repo = pname;
     # Run `eval $(nix-build -A lorri.updater)` after updating the revision!
-    rev = "7b84837b9988d121dd72178e81afd440288106c5";
-    sha256 = "0rkga944jl6i0051vbsddfqbvzy12168cbg4ly2ng1rk0x97dbr8";
+    rev = "88c680c9abf0f04f2e294436d20073ccf26f0781";
+    sha256 = "1415mhdr0pwvshs04clfz1ys76r5qf9jz8jchm63l6llaj6m7mrv";
   };
 
-  cargoSha256 = "0k7l0zhk2vzf4nlwv4xr207irqib2dqjxfdjk1fprff84c4kblx8";
+  cargoSha256 = "1kdpzbn3353yk7i65hll480fcy16wdvppdr6xgfh06x88xhim4mp";
   doCheck = false;
 
   BUILD_REV_COUNT = src.revCount or 1;
diff --git a/pkgs/tools/security/sequoia/default.nix b/pkgs/tools/security/sequoia/default.nix
index 21403225aad..75fc66647e8 100644
--- a/pkgs/tools/security/sequoia/default.nix
+++ b/pkgs/tools/security/sequoia/default.nix
@@ -9,16 +9,16 @@ assert pythonSupport -> pythonPackages != null;
 
 rustPlatform.buildRustPackage rec {
   pname = "sequoia";
-  version = "0.11.0";
+  version = "0.13.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1k0pr3vn77fpfzyvbg7xb4jwm6srsiws9bsd8q7i3hl6j56a880i";
+    sha256 = "0hxdjzd2qjwf9pbnkzrnzlg0xa8vf1f65aryq7pd9895bpnk7740";
   };
 
-  cargoSha256 = "15bhg7b88rq8p0bn6y5wwv2l42kqb1qyx2s3kw0r0v0wadf823q3";
+  cargoSha256 = "0w968ynxqkznp9g1ah040iv6ghwqwqjk1cjlr2f0j5fs57rspzf2";
 
   nativeBuildInputs = [
     pkgconfig
diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index 71a71be9147..842509888b4 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.8.30";
+  version = "1.8.31";
 
   src = fetchurl {
     url = "ftp://ftp.sudo.ws/pub/sudo/${pname}-${version}.tar.gz";
-    sha256 = "1rvrqlqrrjsd06dczgj9cwjdkpkqil5zzlwh87h06ms6qzfx6nm3";
+    sha256 = "0ks5mm9hda5idivncyfpiz4lrd8fv0dpmsl711788k7f7ixdka3y";
   };
 
   prePatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f90ba38fa89..23a5e50f883 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9667,11 +9667,8 @@ in
 
   aws-adfs = with python3Packages; toPythonApplication aws-adfs;
 
-  electron_6 = callPackage ../development/tools/electron/6.x.nix { };
-
-  electron_5 = callPackage ../development/tools/electron/5.x.nix { };
-
-  electron_4 = callPackage ../development/tools/electron { };
+  inherit (callPackages ../development/tools/electron { })
+    electron_4 electron_5 electron_6 electron_7 electron_8;
 
   electron_3 = callPackage ../development/tools/electron/3.x.nix { };
   electron = electron_4;